Cloudflare completes Code Orange resilience program after 2025 outages

Cloudflare announced on May 1 that it had completed the defined work in its Code Orange: Fail Small resilience program. The program report says the changes would have prevented the specific global outages of November 18 and December 5, 2025, while emphasizing that broader resilience work continues.

Configuration now rolls out like software

A new internal component, Snapstone, packages configuration changes for progressive deployment with health monitoring and automated rollback. Cloudflare says relevant teams no longer push traffic-processing configuration instantly across the entire network. Services also reviewed runtime dependencies and chose explicit fail-stale, fail-open, or fail-closed behavior according to the risk of each failure.

The program further segments some services by traffic cohort to reduce blast radius. Cloudflare expanded backup authorization for 18 key internal services and ran an engineering-wide emergency-access drill with more than 200 participants. A dedicated communications team and predictable incident-update intervals address the customer-facing side of recovery.

The durable change is the enforcement loop

Cloudflare codified engineering rules through an internal RFC process and says AI-assisted reviews now flag deviations for additional manual review. The useful pattern is that incident lessons become checked rules and rollout controls, rather than remaining prose in a postmortem.

Other operators can apply the same structure without copying Cloudflare’s internal tools. Start with configuration paths capable of fleet-wide impact, require staged release and automated health gates, then exercise emergency access while normal dependencies are unavailable. Each service should document which degraded behavior protects customers and which would expose data or bypass a security boundary.

Completion of a remediation list is evidence of changed controls, not proof that outages are finished. Drills, production signals, and future incident reviews must keep testing whether those controls still work.