PandaStackEdge caching & CDN
How PandaStack serves app traffic through Cloudflare's global edge — what gets cached, what never does, and how deploys stay instantly fresh.
Every PandaStack app hostname (<app-id>.pandastack.ai and custom domains) is
served through Cloudflare's global network: TLS terminates at the edge near
your users, and cacheable responses are served from 300+ locations without
touching the origin.
What gets cached
| Content | Policy | Why it's safe |
|---|---|---|
Framework contract trees (/_next/static/**, /_app/immutable/**, /_astro/**) | public, max-age=31536000, immutable | These frameworks guarantee every file in the tree is content-addressed — a new build means new filenames |
Hashed assets in conventional dirs (/assets/index-DdQ32mkQ.js, CRA /static/js/main.a3b8c9d0.chunk.js) | immutable — only when the filename carries a content-hash token | Unhashed files in the same dirs (/assets/logo.png) deliberately do not qualify |
| HTML and everything else on static apps | public, max-age=0, must-revalidate + ETag | Every request revalidates against the origin; unchanged content returns a 304, a redeploy is visible immediately |
| Dynamic apps (Next.js SSR, Node, Python, Go…) | Your app's own Cache-Control headers pass through untouched | Your framework already knows what's cacheable — we don't override it |
What is never cached
- Streams — SSE, WebSockets, and exec streams bypass caching end to end.
- Sandbox preview URLs (
<port>-<id>.pandastack.ai) — forcedCache-Control: no-storeat the platform layer, regardless of what the code inside the sandbox sends. The sandbox ID in the hostname is the access credential, so preview responses must never sit in a shared cache. - Wake/starting pages and 404s —
no-store, so an intermediary never retains a transient state page as if it were your app.
How deploys stay fresh
Correctness comes from construction, not from cache invalidation:
- Hashed assets never go stale — a new build produces new filenames.
- HTML always revalidates — the first request after a blue-green flip gets the new document.
- Belt-and-braces: after each static-app flip, PandaStack additionally purges
the entry URLs (
/,/index.html,/404.html) on the platform hostname and all custom domains from Cloudflare's cache.
Operational notes
- Kill switch: setting
PANDASTACK_EDGE_CACHE=0on the control plane reverts all platform-emitted cache headers tono-cachewithout redeploying apps. - Verify behavior from the outside with the
cf-cache-statusresponse header:HIT(served from edge),MISS/EXPIRED(fetched from origin),DYNAMIC(not cacheable by policy). - Bytes served from Cloudflare's cache never reach your sandbox at all, so they cost you nothing in origin compute. (PandaStack does not bill network egress either way — see billing.)
Custom Domains
Serve your app on your own domain — add it, create two DNS records, and TLS is issued and renewed automatically. Subdomains and apex domains supported.
Functions overview
Deploy Python or Node.js functions into isolated PandaStack microVMs — multi-file bundles, GCS storage, ClickHouse metrics, better than Lambda.