SandcutSandbox-first media infrastructure

A refined open-source reference for FFmpeg workloads on Cloudflare Workers, Containers, Durable Objects, and R2.

Seek with intent

Model fast, accurate, and hybrid clip behavior directly in the API instead of hiding critical FFmpeg trade-offs in raw flags.

Stream, not buffer

Keep the Worker lean by streaming container output into R2 rather than reading processed media into memory twice.

Schedule warm capacity

Durable Object leases track active jobs per session so warm containers are reused more rationally under concurrent load.

Reject expensive work early

Preflight HEAD and ranged GET probes let the edge reject oversized inputs before they consume sandbox capacity.

Safer public interface

Sandcut blocks nested inputs, raw seek overrides, and dangerous protocol paths to preserve a cleaner hosted API surface.

Separate docs service

Documentation ships as an independent Pages app so editorial releases never interfere with production media traffic.

Why Sandcut

Sandcut packages a very common workload—video transcoding, clipping, resizing, and watermarking—into a cleaner reference architecture for sandboxed media processing.

The design is intentionally split into two planes:

Edge control plane in the Worker for authentication, validation, scheduling, and storage orchestration
Execution plane in a container for FFmpeg itself

This separation makes the project easier to reason about, safer to expose publicly, and more realistic as an open-source template.

What the docs cover

/guide/quickstart: install, configure, run locally, and deploy
/guide/architecture: request flow, seek planning, and streaming path
/reference/api: endpoint contract and error model
/operations/production: capacity, security, observability, and Pages publishing