netlens.

Where the edge actually lives in 2026

2026-03-10 · Yossi Ben Hagai · 3 min read srenetworkingedge

Edge compute shipped, then atomized. Today “the edge” is five platforms with genuinely different runtime models. Picking between them is a network decision, an observability decision, and a cost decision - in that order, usually ignored in reverse.

The five platforms, compared by what matters

Cloudflare WorkersFastly ComputeVercel EdgeDeno DeployLambda@Edge
RuntimeV8 isolateWasm (Lucet)V8 isolateV8 isolateNode container
Cold start~0ms~0ms~0ms~0ms100ms+
PoPs (approx)300+100+depends on CDN35+CloudFront (400+)
Raw TCP (connect())LimitedNoNoNoNo
WebSocketsYesNoLimitedYesNo
Durable stateDurable Objects, D1, KVKVKV (via vendor)KVNone at edge

None of these are interchangeable drop-ins. The runtime model drives everything else.

What the edge lets you measure

All five platforms expose a per-request geolocation of the PoP (or client) that served the request. Cloudflare’s cf object is the richest, with ASN, country, TLS version, and HTTP protocol all readily available. Fastly exposes similar via VCL/Compute bindings. Vercel Edge and Deno Deploy expose a more limited subset.

What this means in practice: from an edge function you can trivially answer “what is the distribution of requests by country, client HTTP version, and TLS version?” without standing up any telemetry infrastructure beyond a structured log.

What the edge hides

Outbound connection detail

Edge fetch() does the TLS handshake for you and returns a response object. You do not see the peer certificate chain, the negotiated cipher, or the OCSP staple. For a site that is itself behind the edge, this is fine. For a site that is doing diagnostics against third parties, it is a hard limit. netlens hits this limit; we document it in limitations.md and use Certificate Transparency logs as a proxy.

Origin network path

When your edge function calls your origin, you do not control the path. The platform’s private backbone is better than the public internet on average, but it is opaque. You cannot traceroute it. If you need to debug “edge talks to origin slowly from South America but fine from Europe”, you are relying on platform-provided metrics, which vary wildly in quality.

Failure modes you cannot reach from outside

Isolate CPU limits, Wasm memory limits, and request body size limits are all enforced at the runtime boundary. You will see a 1102 (Cloudflare) or similar only in the platform’s dashboard, not in an edge log you control. Set up platform-side error streaming (Cloudflare Logpush, Fastly Real-Time Log Streaming) on day one or you will fly blind.

Choosing

The honest heuristic:

The meta-point

“The edge” is a network architecture choice, not a generic compute tier. Deploy code there because the problem is latency-sensitive, region-aware, or benefits from massive fan-out - not because a blog post said edge is the future. The runtime restrictions are real and they will bite you if you assumed it is “just Node, closer”.

netlens runs on Cloudflare Workers for a specific reason: DNS-over-HTTPS, crt.sh, and target HTTP fetches are all HTTPS calls, which is exactly where the Workers model shines. If any of those needed a raw TCP socket, the deployment target would be different.