System Design (HLD)CDN Providers Comparison

CDN Providers Comparison

LevelAdvanced

Duration75 mins

TopicCDN Providers Comparison

4 / 5

Fastly: The Real-Time Purge CDN

When Milliseconds Matter

Imagine you've just discovered a critical error on your homepage—a pricing typo that shows $9.99 instead of $99.99. With most CDNs, you'd issue a cache purge and wait anxiously for 30 seconds to several minutes while stale content continues being served worldwide. With Fastly, that content is purged globally in less than 150 milliseconds.

This capability isn't just a marketing feature—it fundamentally changes how you can architect applications. When cache invalidation is effectively instant, you can cache aggressively without fear, deliver personalized content at the edge, and treat your CDN as a real-time content platform rather than a static cache layer.

Fastly was founded in 2011 with a radical premise: what if we rebuilt the CDN from scratch, optimized for developers and real-time control? Today, Fastly powers some of the world's most demanding websites—including The New York Times, GitHub, Stripe, and Shopify—each requiring split-second cache control and developer-friendly configuration.

What You Will Learn

By the end of this page, you will understand Fastly's unique architecture built on Varnish, how instant purge works at a technical level, VCL and Compute@Edge programming models, Fastly's approach to observability, and when Fastly is the optimal choice for modern web applications.

Fastly's Origin and Architecture

Fastly was built by engineers from Wikia and Fastly's founder, Artur Bergman, who was frustrated with existing CDNs' slow configuration and purge times. The company made a bold architectural choice: build the entire platform on Varnish Cache, an open-source HTTP accelerator known for its performance and programmability.

The Varnish Foundation:

Varnish Cache was created by Poul-Henning Kamp, a FreeBSD developer, with a fundamentally different philosophy than traditional caches:

Memory-first architecture: Objects live in RAM; disk is only for persistence
Programmable logic: VCL (Varnish Configuration Language) allows arbitrary request handling
Stateless design: Each request can be handled independently
Zero-copy I/O: Minimizes CPU overhead for high throughput

Fastly extended Varnish with global distribution, instant purge mechanisms, real-time logging, and a developer-friendly management interface.

Fastly Network Architecture:

┌────────────────────────────────────────────────────────────────────────────────┐
│                        Fastly Network Architecture                              │
├────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│   DNS Query                                                                     │
│       │                                                                         │
│       ▼                                                                         │
│   ┌─────────────────────┐                                                       │
│   │ Fastly DNS (Anycast)│ → Routes to nearest POP based on geography + health  │
│   └──────────┬──────────┘                                                       │
│              │                                                                  │
│              ▼                                                                  │
│   ┌──────────────────────────────────────────────────────────────────────────┐ │
│   │                         Fastly POP (Edge Cloud)                          │ │
│   │                                                                          │ │
│   │   ┌────────────────────────────────────────────────────────────────────┐│ │
│   │   │                    Cache Cluster                                    ││ │
│   │   │  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐                ││ │
│   │   │  │   Varnish    │ │   Varnish    │ │   Varnish    │                ││ │
│   │   │  │   Instance   │ │   Instance   │ │   Instance   │                ││ │
│   │   │  │              │ │              │ │              │                ││ │
│   │   │  │ • VCL Logic  │ │ • VCL Logic  │ │ • VCL Logic  │                ││ │
│   │   │  │ • RAM Cache  │ │ • RAM Cache  │ │ • RAM Cache  │                ││ │
│   │   │  │ • Compute@Edge│ │ • Compute@Edge│ │ • Compute@Edge│              ││ │
│   │   │  └──────────────┘ └──────────────┘ └──────────────┘                ││ │
│   │   │                        │                                           ││ │
│   │   │            Consistent Hashing for object distribution              ││ │
│   │   └────────────────────────┼───────────────────────────────────────────┘│ │
│   │                            │                                            │ │
│   │            Shield / Origin Fetch (if cache miss)                       │ │
│   └────────────────────────────┼────────────────────────────────────────────┘ │
│                                │                                              │
│                                ▼                                              │
│   ┌──────────────────────────────────────────────────────────────────────────┐│
│   │                         Origin Shield                                    ││
│   │   • Aggregates cache misses from multiple POPs                          ││
│   │   • Reduces origin load                                                 ││
│   │   • Single designate POP per origin                                     ││
│   └──────────────────────────────────────────────────────────────────────────┘│
│                                │                                              │
│                                ▼                                              │
│                         ┌──────────────┐                                      │
│                         │   Origin     │                                      │
│                         │   Server     │                                      │
│                         └──────────────┘                                      │
└────────────────────────────────────────────────────────────────────────────────┘

Key Architectural Differences

•Fewer, larger POPs — Unlike Cloudflare's 300+ edge locations, Fastly operates ~90+ POPs with larger capacity each. This simplifies purge propagation and configuration deployment.
•Hot-hot redundancy — Multiple Varnish instances in each POP serve the same content, with consistent hashing distributing objects. Failure of one instance doesn't impact cache hit ratio.
•Programmable edge — VCL runs on every request, not as an add-on. The entire request lifecycle is scriptable.
•Real-time config deployment — Configuration changes propagate globally in seconds, not minutes. Every developer push is essentially instant.
•Streaming logs — Logs stream in real-time to your destination, not batched. Debug issues as they happen.

Network Scale Trade-off

Fastly's smaller network footprint (90+ vs 300+ POPs) means slightly longer average distance to users compared to Cloudflare. However, larger POPs mean better per-location cache hit ratios. For most applications, the difference is negligible (<10ms), but latency-obsessed use cases should measure specifically.

Instant Purge: How It Works

Fastly's instant purge—completing in under 150 milliseconds globally—is the company's signature capability. Understanding how it works reveals why most CDNs can't replicate it easily.

The Purge Challenge:

Traditional CDNs struggle with fast purging because:

Distributed state: Objects cached across hundreds of locations must be invalidated atomically
Eventual consistency: Propagating invalidation across a global network takes time
Metadata overhead: Tracking which POPs have which objects requires significant coordination
Disk-based caching: Reading from disk to check purge status adds latency

Fastly's Approach:

Fastly solves these challenges through several mechanisms:

Fastly Instant Purge Mechanisms
Mechanism	How It Works	Impact
Memory-first caching	Objects stored in RAM, not disk	No disk I/O delay for purge checks
Centralized purge coordination	Single purge queue processed globally	Consistent ordering, no race conditions
Push-based invalidation	Purge pushed to all POPs simultaneously	No polling delay
Surrogate keys (tags)	Objects tagged with multiple keys for grouped purge	Single API call invalidates related content
Fewer POPs	~90 vs 300+ locations	Smaller blast radius, faster propagation

Surrogate Keys (Cache Tags):

Surrogate keys are Fastly's killer feature for cache invalidation. Instead of purging by URL (which requires knowing every cached URL), you tag content during caching and purge by tag:

Surrogate Key Implementation

# Origin sets Surrogate-Key header during response
# Multiple space-separated keys can be assigned
 
# Product page response
HTTP/1.1 200 OK
Surrogate-Key: product-123 category-electronics homepage featured
Cache-Control: max-age=3600
 
# Article page response  
HTTP/1.1 200 OK
Surrogate-Key: article-456 author-john category-tech homepage
Cache-Control: max-age=1800
 
# User profile response
HTTP/1.1 200 OK
Surrogate-Key: user-789 user-789-avatar user-789-posts
Cache-Control: max-age=600

Designing for Instant Purge

Think of surrogate keys as cache dependencies. Every piece of content should include keys for all the entities it depends on: products it displays, users it mentions, categories it belongs to. When any entity changes, purging its key invalidates all dependent content without knowing specific URLs.

VCL: Varnish Configuration Language

VCL (Varnish Configuration Language) is a domain-specific language that gives you complete control over how Fastly handles every request. Unlike configuration-based CDNs, VCL is actual code that executes on every request.

VCL Subroutines:

VCL code is organized into subroutines that execute at different points in the request lifecycle:

VCL Subroutines and Their Purpose
Subroutine	When It Runs	Common Uses
vcl_recv	Start of request, before cache lookup	Auth check, URL rewrites, routing, request normalization
vcl_hash	Generating cache key	Custom cache key logic, vary by custom headers
vcl_hit	Cache hit found	Modify cached response, check freshness
vcl_miss	Cache miss, before origin fetch	Modify origin request, select backend
vcl_pass	Bypassing cache	Force origin fetch for specific requests
vcl_fetch	Response received from origin	Set caching rules, modify response
vcl_deliver	Before sending to client	Add headers, final modifications
vcl_error	Generating error responses	Custom error pages, synthetic responses

Production VCL Examples

# vcl_recv - Handle incoming requests
sub vcl_recv {
    # Normalize host header to lowercase
    set req.http.Host = std.tolower(req.http.Host);
    
    # Remove tracking query parameters for better cache efficiency
    set req.url = querystring.filter_except(req.url, 
        "page" + querystring.filtersep() + 
        "sort" + querystring.filtersep() + 
        "filter"
    );
    
    # Geographic routing based on client location
    if (client.geo.continent_code == "EU") {
        set req.backend = EU_origin;
    } else if (client.geo.continent_code == "AS") {
        set req.backend = APAC_origin;
    } else {
        set req.backend = US_origin;
    }
    
    # A/B testing - assign variant if not already assigned
    if (!req.http.Cookie:experiment) {
        # Random assignment
        if (randombool(50, 100)) {
            set req.http.X-Experiment = "A";
        } else {
            set req.http.X-Experiment = "B";
        }
    } else {
        set req.http.X-Experiment = req.http.Cookie:experiment;
    }
    
    # Force HTTPS
    if (!req.is_ssl) {
        error 801 "Force HTTPS";
    }
    
    # Protect admin routes
    if (req.url ~ "^/admin" && !req.http.X-Admin-Token) {
        error 403 "Forbidden";
    }
    
    # API requests bypass cache
    if (req.url ~ "^/api/" && req.method != "GET") {
        return(pass);
    }
    
    return(lookup);  # Proceed to cache lookup
}

VCL Learning Curve

VCL is powerful but has a steep learning curve. It's not JavaScript—it's closer to a configuration language with procedural elements. Syntax errors can take down your service. Always test in staging, use Fastly Fiddle for experiments, and start with Fastly's pre-built snippets before writing custom VCL.

Compute@Edge: WebAssembly at the Edge

Compute@Edge is Fastly's answer to Cloudflare Workers—serverless computing at the edge. Unlike VCL, Compute@Edge runs WebAssembly, allowing you to write edge logic in languages like Rust, JavaScript/TypeScript, Go, or any language that compiles to Wasm.

Compute@Edge Architecture:

┌────────────────────────────────────────────────────────────────────────────────┐
│                        Compute@Edge Execution Model                             │
├────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│   Request                                                                       │
│       │                                                                         │
│       ▼                                                                         │
│   ┌───────────────────────────────────────────────────────────┐                │
│   │                   Lucet WebAssembly Runtime                │                │
│   │                                                           │                │
│   │   ┌─────────────────────────────────────────────────────┐ │                │
│   │   │            Your Wasm Module                          │ │                │
│   │   │                                                     │ │                │
│   │   │   • Written in Rust, JS, Go, AssemblyScript, etc.  │ │                │
│   │   │   • Compiled to WebAssembly                         │ │                │
│   │   │   • Runs in isolated sandbox                        │ │                │
│   │   │   • 50ms startup time (vs 100ms+ for Lambda@Edge)   │ │                │
│   │   │                                                     │ │                │
│   │   │   Available APIs:                                   │ │                │
│   │   │   • HTTP request/response manipulation              │ │                │
│   │   │   • KV Store access                                 │ │                │
│   │   │   • Secret Store                                    │ │                │
│   │   │   • Config Store                                    │ │                │
│   │   │   • Geolocation data                                │ │                │
│   │   │   • Outbound fetch (to backends or internet)        │ │                │
│   │   └─────────────────────────────────────────────────────┘ │                │
│   └───────────────────────────────────────────────────────────┘                │
│       │                                                                         │
│       ▼                                                                         │
│   Response or Backend Fetch                                                     │
└────────────────────────────────────────────────────────────────────────────────┘

Compute@Edge Examples
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
use fastly::http::{header, Method, StatusCode};
use fastly::{Error, Request, Response};
 
/// Main entry point for Compute@Edge
#[fastly::main]
fn main(req: Request) -> Result<Response, Error> {
    // Log request for debugging
    println!("Request: {} {}", req.get_method(), req.get_path());
    
    // Route based on path
    match req.get_path() {
        // Health check endpoint
        "/health" => Ok(Response::from_status(StatusCode::OK)
            .with_body("OK")),
        
        // API endpoint with authentication
        path if path.starts_with("/api/") => handle_api(req),
        
        // Static content from backend
        _ => handle_static(req),
    }
}
 
fn handle_api(mut req: Request) -> Result<Response, Error> {
    // Validate JWT token
    let auth_header = req.get_header_str(header::AUTHORIZATION);
    
    match auth_header {
        Some(token) if validate_jwt(token) => {
            // Forward to API backend
            let backend = fastly::Backend::from_name("api_origin")?;
            req.send(backend)
        }
        _ => {
            Ok(Response::from_status(StatusCode::UNAUTHORIZED)
                .with_body_json(&serde_json::json!({
                    "error": "Invalid or missing authentication token"
                }))?)
        }
    }
}
 
fn handle_static(req: Request) -> Result<Response, Error> {
    // Check KV store for feature flags
    let kv_store = fastly::KVStore::open("config")?.unwrap();
    let maintenance_mode = kv_store
        .lookup("maintenance_mode")
        .map(|v| v.into_string() == "true")
        .unwrap_or(false);
    
    if maintenance_mode {
        return Ok(Response::from_status(StatusCode::SERVICE_UNAVAILABLE)
            .with_body("Site under maintenance"));
    }
    
    // Fetch from origin
    let backend = fastly::Backend::from_name("static_origin")?;
    let mut resp = req.send(backend)?;
    
    // Add security headers
    resp.set_header("Strict-Transport-Security", "max-age=31536000");
    resp.set_header("X-Content-Type-Options", "nosniff");
    
    Ok(resp)
}
 
fn validate_jwt(token: &str) -> bool {
    // JWT validation logic
    // In production, use jsonwebtoken crate
    token.starts_with("Bearer valid_")
}

Compute@Edge Advantages

•Write in Rust, JS, Go, or any Wasm language
•Sub-50ms cold starts (WebAssembly efficiency)
•Access to Fastly's KV, Secret, Config stores
•Full HTTP/2 and WebSocket support
•Integrates with instant purge system
•No vendor lock-in (Wasm is portable)

Compute@Edge Limitations

•Newer platform, less mature ecosystem
•Smaller community than Cloudflare Workers
•More complex development workflow
•Higher pricing than Cloudflare
•Some APIs still in development
•Debugging tools less polished

Real-Time Observability

Fastly's approach to observability is distinctly real-time. Unlike CDNs that batch logs and deliver them minutes later, Fastly streams logs and metrics as they happen.

Real-Time Log Streaming:

Fastly can stream logs to any HTTP endpoint, syslog server, or popular log management platforms:

Fastly Log Streaming Destinations
Destination	Latency	Use Case
HTTPS Endpoint	< 1 second	Custom log processing pipelines
Amazon S3	< 5 seconds	Long-term storage, batch analysis
Google Cloud Storage	< 5 seconds	GCP ecosystem integration
Datadog	< 2 seconds	Real-time monitoring, alerting
Splunk	< 2 seconds	Security analysis, SIEM
Elasticsearch	< 3 seconds	Full-text search, Kibana dashboards
BigQuery	< 10 seconds	SQL analytics on log data
New Relic	< 2 seconds	APM integration

Custom Log Formats with VCL:

Fastly lets you define exactly what gets logged using VCL, enabling custom analytics:

Custom Log Configuration

# Log JSON format for structured logging
sub vcl_log {
    # Stream to configured endpoint
    log "analytics" 
        "{"
        ""timestamp":"" + strftime({"%Y-%m-%dT%H:%M:%SZ"}, now) + "","
        ""client_ip":"" + client.ip + "","
        ""method":"" + req.method + "","
        ""url":"" + req.url + "","
        ""status":" + resp.status + ","
        ""bytes":" + resp.body_bytes_written + ","
        ""cache":"" + fastly_info.state + "","
        ""ttfb":" + time.to_first_byte + ","
        ""country":"" + client.geo.country_code + "","
        ""asn":" + client.as.number + ","
        ""pop":"" + server.datacenter + "","
        ""user_agent":"" + req.http.User-Agent + """
        "}";
}

Debugging with Real-Time Logs

Fastly's real-time logs transform debugging. Instead of waiting for batch logs to identify issues, you can watch requests flow through in real-time. Combine with Fastly Fiddle (live VCL testing) for a powerful development workflow: make VCL changes, see immediate log output, iterate quickly.

Security Capabilities

Fastly's security approach differs from Cloudflare's comprehensive, built-in model. Instead, Fastly offers modular security products that integrate with its CDN platform.

Fastly Next-Gen WAF:

Fastly acquired Signal Sciences in 2020, gaining one of the most advanced WAF technologies in the market:

Next-Gen WAF Capabilities

•Agent-based architecture — Deploys alongside your application, not just at the edge. Provides application-aware protection.
•SmartParse technology — Analyzes request context rather than pattern matching. Reduces false positives dramatically.
•Rate limiting — Advanced rate limiting with sliding windows, multiple thresholds, and custom keys.
•Bot detection — Behavioral analysis to distinguish bots from humans without CAPTCHAs.
•API protection — OpenAPI/Swagger-aware validation, schema enforcement.
•Account takeover protection — Credential stuffing detection, compromised credential checking.

DDoS Protection:

Fastly provides DDoS protection at the network layer automatically, with application-layer protection available through the WAF:

Anycast absorption: Distributed network absorbs volumetric attacks
Automatic mitigation: No configuration required for L3/L4 attacks
VCL-based rules: Custom rate limiting and blocking via VCL for L7
Emergency response: 24/7 support for enterprise customers during attacks

Security Add-on Pricing

Unlike Cloudflare's included security, Fastly's Next-Gen WAF is a separate product with significant additional cost. Expect $10,000-100,000+ annually depending on traffic and features. For budget-conscious projects, Cloudflare may offer better security value.

Fastly Pricing Model

Fastly uses consumption-based pricing similar to traditional CDNs, with some unique aspects around developer tooling and Compute@Edge.

Pricing Components:

Fastly Pricing Overview
Component	Rate	Notes
Bandwidth (US/Europe)	$0.08/GB first 10TB	Decreasing tiers with volume
Bandwidth (Asia/Oceania)	$0.12-0.19/GB	Higher rates outside US/Europe
Requests	$0.0075/10K requests	HTTP/HTTPS combined
Compute@Edge	$0.50/million invocations	Plus $12.80/million GB-seconds compute
Real-time logs	Free	Included with CDN
Origin Shield	Included	No additional charge
Image Optimizer	$0.002/image transform	Optional add-on
Next-Gen WAF	Custom pricing	Starts ~$10K annually

Fastly vs Competitors Pricing:

CDN Pricing Comparison (Approximate)
Feature	Fastly	Cloudflare	CloudFront
100GB bandwidth	~$8	$0 (unmetered)	~$8.50
1TB bandwidth	~$80	$0 (unmetered)	~$85
1M edge compute invocations	$0.50	$0.30	$0.60
Instant purge	Included	~30s delay	~30s delay
WAF included	No (add-on)	Yes	No (add-on)
Real-time logs	Included	Yes (10M/day free)	Optional ($)

Free Tier Note

Fastly offers a developer-friendly free tier: $50 of free usage per month, which covers approximately 500GB of bandwidth and 5 million requests. This makes experimentation and development accessible without upfront commitment.

When to Choose Fastly

Fastly excels for specific workloads where real-time control and developer experience are paramount:

Fastly Is Ideal When

•Content freshness is critical — News sites, stock prices, live scores need instant purge
•Complex edge logic required — VCL's power exceeds configuration-based CDNs
•Real-time debugging needed — Streaming logs and Fastly Fiddle accelerate development
•High-traffic media sites — New York Times, The Guardian, Vox Media use Fastly
•API caching with fine control — Surrogate keys enable precise cache invalidation
•Developer experience prioritized — Teams that value observability and control

Consider Alternatives When

•Budget is primary concern — Cloudflare's unmetered model is often cheaper
•Security must be included — Cloudflare WAF/DDoS is built-in; Fastly's is extra
•Simplicity over power — Cloudflare is easier to configure for basic use cases
•AWS-native stack — CloudFront integrates better with AWS services
•Maximum global presence — Cloudflare has 3x more edge locations
•Enterprise scale streaming — Akamai handles larger live events

Page Complete

You now understand Fastly's unique value proposition: instant purge, VCL programmability, Compute@Edge, and real-time observability. This makes Fastly ideal for content-heavy sites requiring split-second cache control. Next, we'll synthesize all CDN providers into a decision framework for choosing the optimal solution.

4 / 5

Loading learning content...

System Design (HLD)CDN Providers Comparison

CDN Providers Comparison

LevelAdvanced

Duration75 mins

TopicCDN Providers Comparison

4 / 5

Fastly: The Real-Time Purge CDN

When Milliseconds Matter

What You Will Learn

Fastly's Origin and Architecture

The Varnish Foundation:

Varnish Cache was created by Poul-Henning Kamp, a FreeBSD developer, with a fundamentally different philosophy than traditional caches:

Memory-first architecture: Objects live in RAM; disk is only for persistence
Programmable logic: VCL (Varnish Configuration Language) allows arbitrary request handling
Stateless design: Each request can be handled independently
Zero-copy I/O: Minimizes CPU overhead for high throughput

Fastly extended Varnish with global distribution, instant purge mechanisms, real-time logging, and a developer-friendly management interface.

Fastly Network Architecture:

┌────────────────────────────────────────────────────────────────────────────────┐
│                        Fastly Network Architecture                              │
├────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│   DNS Query                                                                     │
│       │                                                                         │
│       ▼                                                                         │
│   ┌─────────────────────┐                                                       │
│   │ Fastly DNS (Anycast)│ → Routes to nearest POP based on geography + health  │
│   └──────────┬──────────┘                                                       │
│              │                                                                  │
│              ▼                                                                  │
│   ┌──────────────────────────────────────────────────────────────────────────┐ │
│   │                         Fastly POP (Edge Cloud)                          │ │
│   │                                                                          │ │
│   │   ┌────────────────────────────────────────────────────────────────────┐│ │
│   │   │                    Cache Cluster                                    ││ │
│   │   │  ┌──────────────┐ ┌──────────────┐ ┌──────────────┐                ││ │
│   │   │  │   Varnish    │ │   Varnish    │ │   Varnish    │                ││ │
│   │   │  │   Instance   │ │   Instance   │ │   Instance   │                ││ │
│   │   │  │              │ │              │ │              │                ││ │
│   │   │  │ • VCL Logic  │ │ • VCL Logic  │ │ • VCL Logic  │                ││ │
│   │   │  │ • RAM Cache  │ │ • RAM Cache  │ │ • RAM Cache  │                ││ │
│   │   │  │ • Compute@Edge│ │ • Compute@Edge│ │ • Compute@Edge│              ││ │
│   │   │  └──────────────┘ └──────────────┘ └──────────────┘                ││ │
│   │   │                        │                                           ││ │
│   │   │            Consistent Hashing for object distribution              ││ │
│   │   └────────────────────────┼───────────────────────────────────────────┘│ │
│   │                            │                                            │ │
│   │            Shield / Origin Fetch (if cache miss)                       │ │
│   └────────────────────────────┼────────────────────────────────────────────┘ │
│                                │                                              │
│                                ▼                                              │
│   ┌──────────────────────────────────────────────────────────────────────────┐│
│   │                         Origin Shield                                    ││
│   │   • Aggregates cache misses from multiple POPs                          ││
│   │   • Reduces origin load                                                 ││
│   │   • Single designate POP per origin                                     ││
│   └──────────────────────────────────────────────────────────────────────────┘│
│                                │                                              │
│                                ▼                                              │
│                         ┌──────────────┐                                      │
│                         │   Origin     │                                      │
│                         │   Server     │                                      │
│                         └──────────────┘                                      │
└────────────────────────────────────────────────────────────────────────────────┘

Key Architectural Differences

•Fewer, larger POPs — Unlike Cloudflare's 300+ edge locations, Fastly operates ~90+ POPs with larger capacity each. This simplifies purge propagation and configuration deployment.
•Hot-hot redundancy — Multiple Varnish instances in each POP serve the same content, with consistent hashing distributing objects. Failure of one instance doesn't impact cache hit ratio.
•Programmable edge — VCL runs on every request, not as an add-on. The entire request lifecycle is scriptable.
•Real-time config deployment — Configuration changes propagate globally in seconds, not minutes. Every developer push is essentially instant.
•Streaming logs — Logs stream in real-time to your destination, not batched. Debug issues as they happen.

Network Scale Trade-off

Instant Purge: How It Works

Fastly's instant purge—completing in under 150 milliseconds globally—is the company's signature capability. Understanding how it works reveals why most CDNs can't replicate it easily.

The Purge Challenge:

Traditional CDNs struggle with fast purging because:

Distributed state: Objects cached across hundreds of locations must be invalidated atomically
Eventual consistency: Propagating invalidation across a global network takes time
Metadata overhead: Tracking which POPs have which objects requires significant coordination
Disk-based caching: Reading from disk to check purge status adds latency

Fastly's Approach:

Fastly solves these challenges through several mechanisms:

Fastly Instant Purge Mechanisms
Mechanism	How It Works	Impact
Memory-first caching	Objects stored in RAM, not disk	No disk I/O delay for purge checks
Centralized purge coordination	Single purge queue processed globally	Consistent ordering, no race conditions
Push-based invalidation	Purge pushed to all POPs simultaneously	No polling delay
Surrogate keys (tags)	Objects tagged with multiple keys for grouped purge	Single API call invalidates related content
Fewer POPs	~90 vs 300+ locations	Smaller blast radius, faster propagation

Surrogate Keys (Cache Tags):

Surrogate keys are Fastly's killer feature for cache invalidation. Instead of purging by URL (which requires knowing every cached URL), you tag content during caching and purge by tag:

Surrogate Key Implementation

# Origin sets Surrogate-Key header during response
# Multiple space-separated keys can be assigned
 
# Product page response
HTTP/1.1 200 OK
Surrogate-Key: product-123 category-electronics homepage featured
Cache-Control: max-age=3600
 
# Article page response  
HTTP/1.1 200 OK
Surrogate-Key: article-456 author-john category-tech homepage
Cache-Control: max-age=1800
 
# User profile response
HTTP/1.1 200 OK
Surrogate-Key: user-789 user-789-avatar user-789-posts
Cache-Control: max-age=600

Designing for Instant Purge

VCL: Varnish Configuration Language

VCL Subroutines:

VCL code is organized into subroutines that execute at different points in the request lifecycle:

VCL Subroutines and Their Purpose
Subroutine	When It Runs	Common Uses
vcl_recv	Start of request, before cache lookup	Auth check, URL rewrites, routing, request normalization
vcl_hash	Generating cache key	Custom cache key logic, vary by custom headers
vcl_hit	Cache hit found	Modify cached response, check freshness
vcl_miss	Cache miss, before origin fetch	Modify origin request, select backend
vcl_pass	Bypassing cache	Force origin fetch for specific requests
vcl_fetch	Response received from origin	Set caching rules, modify response
vcl_deliver	Before sending to client	Add headers, final modifications
vcl_error	Generating error responses	Custom error pages, synthetic responses

Production VCL Examples

# vcl_recv - Handle incoming requests
sub vcl_recv {
    # Normalize host header to lowercase
    set req.http.Host = std.tolower(req.http.Host);
    
    # Remove tracking query parameters for better cache efficiency
    set req.url = querystring.filter_except(req.url, 
        "page" + querystring.filtersep() + 
        "sort" + querystring.filtersep() + 
        "filter"
    );
    
    # Geographic routing based on client location
    if (client.geo.continent_code == "EU") {
        set req.backend = EU_origin;
    } else if (client.geo.continent_code == "AS") {
        set req.backend = APAC_origin;
    } else {
        set req.backend = US_origin;
    }
    
    # A/B testing - assign variant if not already assigned
    if (!req.http.Cookie:experiment) {
        # Random assignment
        if (randombool(50, 100)) {
            set req.http.X-Experiment = "A";
        } else {
            set req.http.X-Experiment = "B";
        }
    } else {
        set req.http.X-Experiment = req.http.Cookie:experiment;
    }
    
    # Force HTTPS
    if (!req.is_ssl) {
        error 801 "Force HTTPS";
    }
    
    # Protect admin routes
    if (req.url ~ "^/admin" && !req.http.X-Admin-Token) {
        error 403 "Forbidden";
    }
    
    # API requests bypass cache
    if (req.url ~ "^/api/" && req.method != "GET") {
        return(pass);
    }
    
    return(lookup);  # Proceed to cache lookup
}

VCL Learning Curve

Compute@Edge: WebAssembly at the Edge

Compute@Edge Architecture:

┌────────────────────────────────────────────────────────────────────────────────┐
│                        Compute@Edge Execution Model                             │
├────────────────────────────────────────────────────────────────────────────────┤
│                                                                                 │
│   Request                                                                       │
│       │                                                                         │
│       ▼                                                                         │
│   ┌───────────────────────────────────────────────────────────┐                │
│   │                   Lucet WebAssembly Runtime                │                │
│   │                                                           │                │
│   │   ┌─────────────────────────────────────────────────────┐ │                │
│   │   │            Your Wasm Module                          │ │                │
│   │   │                                                     │ │                │
│   │   │   • Written in Rust, JS, Go, AssemblyScript, etc.  │ │                │
│   │   │   • Compiled to WebAssembly                         │ │                │
│   │   │   • Runs in isolated sandbox                        │ │                │
│   │   │   • 50ms startup time (vs 100ms+ for Lambda@Edge)   │ │                │
│   │   │                                                     │ │                │
│   │   │   Available APIs:                                   │ │                │
│   │   │   • HTTP request/response manipulation              │ │                │
│   │   │   • KV Store access                                 │ │                │
│   │   │   • Secret Store                                    │ │                │
│   │   │   • Config Store                                    │ │                │
│   │   │   • Geolocation data                                │ │                │
│   │   │   • Outbound fetch (to backends or internet)        │ │                │
│   │   └─────────────────────────────────────────────────────┘ │                │
│   └───────────────────────────────────────────────────────────┘                │
│       │                                                                         │
│       ▼                                                                         │
│   Response or Backend Fetch                                                     │
└────────────────────────────────────────────────────────────────────────────────┘

Compute@Edge Examples
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
use fastly::http::{header, Method, StatusCode};
use fastly::{Error, Request, Response};
 
/// Main entry point for Compute@Edge
#[fastly::main]
fn main(req: Request) -> Result<Response, Error> {
    // Log request for debugging
    println!("Request: {} {}", req.get_method(), req.get_path());
    
    // Route based on path
    match req.get_path() {
        // Health check endpoint
        "/health" => Ok(Response::from_status(StatusCode::OK)
            .with_body("OK")),
        
        // API endpoint with authentication
        path if path.starts_with("/api/") => handle_api(req),
        
        // Static content from backend
        _ => handle_static(req),
    }
}
 
fn handle_api(mut req: Request) -> Result<Response, Error> {
    // Validate JWT token
    let auth_header = req.get_header_str(header::AUTHORIZATION);
    
    match auth_header {
        Some(token) if validate_jwt(token) => {
            // Forward to API backend
            let backend = fastly::Backend::from_name("api_origin")?;
            req.send(backend)
        }
        _ => {
            Ok(Response::from_status(StatusCode::UNAUTHORIZED)
                .with_body_json(&serde_json::json!({
                    "error": "Invalid or missing authentication token"
                }))?)
        }
    }
}
 
fn handle_static(req: Request) -> Result<Response, Error> {
    // Check KV store for feature flags
    let kv_store = fastly::KVStore::open("config")?.unwrap();
    let maintenance_mode = kv_store
        .lookup("maintenance_mode")
        .map(|v| v.into_string() == "true")
        .unwrap_or(false);
    
    if maintenance_mode {
        return Ok(Response::from_status(StatusCode::SERVICE_UNAVAILABLE)
            .with_body("Site under maintenance"));
    }
    
    // Fetch from origin
    let backend = fastly::Backend::from_name("static_origin")?;
    let mut resp = req.send(backend)?;
    
    // Add security headers
    resp.set_header("Strict-Transport-Security", "max-age=31536000");
    resp.set_header("X-Content-Type-Options", "nosniff");
    
    Ok(resp)
}
 
fn validate_jwt(token: &str) -> bool {
    // JWT validation logic
    // In production, use jsonwebtoken crate
    token.starts_with("Bearer valid_")
}

Compute@Edge Advantages

•Write in Rust, JS, Go, or any Wasm language
•Sub-50ms cold starts (WebAssembly efficiency)
•Access to Fastly's KV, Secret, Config stores
•Full HTTP/2 and WebSocket support
•Integrates with instant purge system
•No vendor lock-in (Wasm is portable)

Compute@Edge Limitations

•Newer platform, less mature ecosystem
•Smaller community than Cloudflare Workers
•More complex development workflow
•Higher pricing than Cloudflare
•Some APIs still in development
•Debugging tools less polished

Real-Time Observability

Fastly's approach to observability is distinctly real-time. Unlike CDNs that batch logs and deliver them minutes later, Fastly streams logs and metrics as they happen.

Real-Time Log Streaming:

Fastly can stream logs to any HTTP endpoint, syslog server, or popular log management platforms:

Fastly Log Streaming Destinations
Destination	Latency	Use Case
HTTPS Endpoint	< 1 second	Custom log processing pipelines
Amazon S3	< 5 seconds	Long-term storage, batch analysis
Google Cloud Storage	< 5 seconds	GCP ecosystem integration
Datadog	< 2 seconds	Real-time monitoring, alerting
Splunk	< 2 seconds	Security analysis, SIEM
Elasticsearch	< 3 seconds	Full-text search, Kibana dashboards
BigQuery	< 10 seconds	SQL analytics on log data
New Relic	< 2 seconds	APM integration

Custom Log Formats with VCL:

Fastly lets you define exactly what gets logged using VCL, enabling custom analytics:

Custom Log Configuration

# Log JSON format for structured logging
sub vcl_log {
    # Stream to configured endpoint
    log "analytics" 
        "{"
        ""timestamp":"" + strftime({"%Y-%m-%dT%H:%M:%SZ"}, now) + "","
        ""client_ip":"" + client.ip + "","
        ""method":"" + req.method + "","
        ""url":"" + req.url + "","
        ""status":" + resp.status + ","
        ""bytes":" + resp.body_bytes_written + ","
        ""cache":"" + fastly_info.state + "","
        ""ttfb":" + time.to_first_byte + ","
        ""country":"" + client.geo.country_code + "","
        ""asn":" + client.as.number + ","
        ""pop":"" + server.datacenter + "","
        ""user_agent":"" + req.http.User-Agent + """
        "}";
}

Debugging with Real-Time Logs

Security Capabilities

Fastly's security approach differs from Cloudflare's comprehensive, built-in model. Instead, Fastly offers modular security products that integrate with its CDN platform.

Fastly Next-Gen WAF:

Fastly acquired Signal Sciences in 2020, gaining one of the most advanced WAF technologies in the market:

Next-Gen WAF Capabilities

•Agent-based architecture — Deploys alongside your application, not just at the edge. Provides application-aware protection.
•SmartParse technology — Analyzes request context rather than pattern matching. Reduces false positives dramatically.
•Rate limiting — Advanced rate limiting with sliding windows, multiple thresholds, and custom keys.
•Bot detection — Behavioral analysis to distinguish bots from humans without CAPTCHAs.
•API protection — OpenAPI/Swagger-aware validation, schema enforcement.
•Account takeover protection — Credential stuffing detection, compromised credential checking.

DDoS Protection:

Fastly provides DDoS protection at the network layer automatically, with application-layer protection available through the WAF:

Anycast absorption: Distributed network absorbs volumetric attacks
Automatic mitigation: No configuration required for L3/L4 attacks
VCL-based rules: Custom rate limiting and blocking via VCL for L7
Emergency response: 24/7 support for enterprise customers during attacks

Security Add-on Pricing

Fastly Pricing Model

Fastly uses consumption-based pricing similar to traditional CDNs, with some unique aspects around developer tooling and Compute@Edge.

Pricing Components:

Fastly Pricing Overview
Component	Rate	Notes
Bandwidth (US/Europe)	$0.08/GB first 10TB	Decreasing tiers with volume
Bandwidth (Asia/Oceania)	$0.12-0.19/GB	Higher rates outside US/Europe
Requests	$0.0075/10K requests	HTTP/HTTPS combined
Compute@Edge	$0.50/million invocations	Plus $12.80/million GB-seconds compute
Real-time logs	Free	Included with CDN
Origin Shield	Included	No additional charge
Image Optimizer	$0.002/image transform	Optional add-on
Next-Gen WAF	Custom pricing	Starts ~$10K annually

Fastly vs Competitors Pricing:

CDN Pricing Comparison (Approximate)
Feature	Fastly	Cloudflare	CloudFront
100GB bandwidth	~$8	$0 (unmetered)	~$8.50
1TB bandwidth	~$80	$0 (unmetered)	~$85
1M edge compute invocations	$0.50	$0.30	$0.60
Instant purge	Included	~30s delay	~30s delay
WAF included	No (add-on)	Yes	No (add-on)
Real-time logs	Included	Yes (10M/day free)	Optional ($)

Free Tier Note

When to Choose Fastly

Fastly excels for specific workloads where real-time control and developer experience are paramount:

Fastly Is Ideal When

•Content freshness is critical — News sites, stock prices, live scores need instant purge
•Complex edge logic required — VCL's power exceeds configuration-based CDNs
•Real-time debugging needed — Streaming logs and Fastly Fiddle accelerate development
•High-traffic media sites — New York Times, The Guardian, Vox Media use Fastly
•API caching with fine control — Surrogate keys enable precise cache invalidation
•Developer experience prioritized — Teams that value observability and control

Consider Alternatives When

•Budget is primary concern — Cloudflare's unmetered model is often cheaper
•Security must be included — Cloudflare WAF/DDoS is built-in; Fastly's is extra
•Simplicity over power — Cloudflare is easier to configure for basic use cases
•AWS-native stack — CloudFront integrates better with AWS services
•Maximum global presence — Cloudflare has 3x more edge locations
•Enterprise scale streaming — Akamai handles larger live events

Page Complete

4 / 5