Why Cloud Run + Cloudflare Beats VMs for Multi-Tenant Hosting

I operate a platform that hosts thousands of sites on Google Cloud Run behind Cloudflare. People ask why I didn't just use VMs, it's the "obvious" way to host websites. The short answer: for a fleet of many, mostly-idle tenants, VMs lose on cost, scaling, security, and operations at the same time. Here's the detailed reasoning, including where VMs do still win.

The core mismatch: VMs bill for time, traffic arrives in bursts

A VM bills for every second it runs, whether it serves one request or none. Multi-tenant hosting has a specific shape: most sites are idle most of the time, with occasional, unpredictable spikes.

• VMs: you provision for peak, then pay for that capacity 24/7 even though it's mostly unused. Stack thousands of tenants and you're paying for an enormous amount of idle compute.
• Cloud Run: scales each service to zero when idle and out on demand. You pay for requests, not for reserved time. The bill tracks actual traffic.

For mostly-idle, many-tenant workloads, that difference alone is the ballgame.

Cost

	VMs (always-on)	Cloud Run (serverless)
Idle sites	Paid for, 24/7	~Free (scale to zero)
Spikes	Over-provision or fall over	Auto-scales out
Capacity planning	Per-tenant, constant	None
Cost model	Pay for time	Pay for requests

Put a CDN (Cloudflare) in front and the win compounds: most requests are served from the edge cache and never reach the origin at all, so you pay for even fewer Cloud Run invocations.

Scaling

• VMs scale by adding machines and load balancers: minutes to react, and you own the autoscaler config, health checks, and capacity math.
• Cloud Run scales per service automatically and near-instantly, with no infrastructure to tune. A tenant going viral scales just that service; the rest stay at zero.

Security

This is underrated. With VMs you patch the OS, manage SSH, lock down the network, and harden each host. Across thousands of tenants that's a huge, ongoing attack surface.

• Cloud Run has no host to patch or SSH into: Google manages the runtime. Your surface is the container, which is far smaller.
• Cloudflare applies WAF, DDoS protection, bot management, and TLS once, at the edge, across every hostname. You secure the fleet in one place instead of per-VM.

Operations

• VMs: OS patching, kernel updates, capacity, autoscaler tuning, certificate management per host.
• Cloud Run + Cloudflare: deploy a container; the platform handles the rest. TLS, scaling, and edge delivery are managed. A small team can run thousands of sites.

Where VMs (or other options) still win

I'm not anti-VM, use the right tool:

• Long-lived stateful workloads (databases, stateful brokers) don't belong on scale-to-zero serverless. Use managed services or VMs.
• Heavy, constant traffic with predictable load can be cheaper on committed VMs/containers than per-request pricing, run the numbers.
• Special runtime needs (GPUs, custom kernels, long-running background processes beyond request timeouts) may need VMs or GKE.
• Cold starts matter for latency-critical, rarely-hit endpoints: mitigate with min-instances, or reconsider serverless for those specific services.

The decision framework

Reach for Cloud Run + Cloudflare when:

• You host many tenants/services that are individually mostly idle.
• Traffic is spiky and unpredictable.
• You want security and TLS handled centrally.
• You have a small team and want minimal infrastructure to operate.

Reach for VMs/GKE when:

• Workloads are stateful, long-running, or need special runtimes.
• Traffic is high and steady enough that committed capacity is cheaper.

Bottom line

For multi-tenant web hosting, many sites, mostly idle, spiky, security-sensitive, Cloud Run behind Cloudflare wins on all four axes that matter: cost, scaling, security, and operations. That's why my platform serves 5,000+ sites on it. (The full build is in my case study.)

---

Designing a hosting or multi-tenant platform and weighing the options? That's my work, see my services or reach out.