The blog post went up on a Tuesday morning, and by Wednesday afternoon, it had become one of those rare tech discussions that transcends the usual tribal warfare. "Dropping Cloudflare for bunny.net"—a title that sounds almost mundane until you consider what it represents—climbed to the front page of Hacker News in April 2026, pulling in more than 340 points and nearly 180 comments as of April 3rd. Engineers piled into the thread, and the debate that followed wasn't really about content delivery networks at all.
It was about something harder to quantify: the moment when dominant infrastructure becomes a concentration risk you can no longer ignore.
Maybe it was inevitable. Cloudflare—the 800-pound gorilla of CDN and edge computing—experienced outages on November 18, 2025, December 5, 2025, and February 20, 2026. Meanwhile, new European switching regulations kicked in, and a wave of industry consolidation left entire categories of alternatives shuttered or absorbed. The CDN market, valued at roughly $27 billion and projected by MarketsandMarkets to hit nearly $43 billion by 2030, was being remade. Not by some flashy new technology, but by the quiet realization among technical teams that putting all your eggs in one basket might be riskier than the uptime statistics suggest.
When the Network Isn't Working
November 18, 2025. That was the first crack—Cloudflare's worst global outage since 2019. The proximate cause, detailed in a postmortem the company published the next day, traced back to a bot-management database permission change that cascaded through the network in ways nobody anticipated. Technical failures happen. What matters is what came next.
Five days into December: another outage, related to the November incident closely enough to suggest a pattern rather than a fluke. Then February 20, 2026 arrived with a BGP route withdrawal that hit BYOIP (Bring Your Own IP) customers particularly hard. ThousandEyes and Blue Triangle, services that monitor internet performance from countless vantage points, documented the ripple effects in real time.
But perhaps more revealing were the conversations happening in less official venues. On Reddit's r/sysadmin, throughout November and December, the same phrase kept surfacing in thread after thread: multi-CDN failover. One administrator captured the sentiment bluntly in late November: "Yesterday's Cloudflare outage exposed a huge blind spot."
These weren't casual WordPress users complaining about downtime. These were infrastructure engineers who'd treated CDN selection as a solved problem, suddenly pulling out whiteboards to sketch backup architectures they'd never seriously considered building before. When your 99.99% uptime promise gets tested three times in four months, the calculus changes.
The Regulatory Quiet Before the Storm
While outages grabbed attention, a different kind of pressure was building—the regulatory sort. The EU Data Act, fully operational since September 2025, includes language that's easy to miss but potentially transformative. By January 2027, switching and egress fees will be banned entirely within EU jurisdiction. There's a transition period allowing cost-based fees until then, but the trajectory is unmistakable.
For infrastructure teams, this matters more than it might appear. Moving terabytes—or petabytes—of data between cloud providers has historically been expensive enough to function as de facto lock-in. You might want to switch, but the egress bill makes staying put the rational choice. The Data Act removes that handcuff, at least for European operations.
The sovereignty dimension runs deeper than just regulation, though. A Gartner report from March 2026 projected that sovereign infrastructure spending across Europe would triple between 2025 and 2027. According to analysis from ITPro, roughly a fifth of workloads are expected to remain within European borders rather than flowing to US-based hyperscalers. This isn't purely about compliance checkboxes—it reflects a growing discomfort with US surveillance frameworks, a concern that became concrete when Swiss government guidance urged citizens away from Microsoft 365 over encryption gaps.
For companies based in the EU, or serving European customers, jurisdiction is no longer fine print. It's architecture.
The Slovenian Alternative Making Noise
Which brings us to Bunny.net, the Slovenian upstart that's become something of a rallying point for the "developer-first" movement. Founded by Dejan Grofelnik Pelzel, the company pulled in a $6 million seed round back in October 2022 from Runa Capital and Capital Genetics. LinkedIn pegs the team somewhere between 51 and 200 employees as of this spring—a range that reflects the opacity common among private companies, and perhaps a company growing faster than its own headcount data can keep up with.
The technical specifications read impressively: 119 points of presence spanning 77 countries, north of 250 terabits per second in capacity, and what the company claims is a 95% average cache hit ratio. Bunny.net claims to power 1.5 million websites according to their promotional materials, though that figure lacks independent verification.
What really resonates, though—particularly with cost-conscious teams—is the pricing structure. CDN delivery starts at a penny per gigabyte for North America and Europe. Straightforward. Predictable. And roughly an order of magnitude cheaper than hyperscaler alternatives for many workloads. Volume tiers bring costs down further: half a cent per gigabyte up to 500 terabytes monthly, then $0.004 for 500TB to 1PB, dropping to $0.002 for the 1-2 petabyte range.
Then there's the Backblaze partnership, first announced in October 2022 and still running. The integration between Backblaze B2 storage and Bunny CDN eliminates egress fees entirely—a pairing that fundamentally shifts total cost of ownership for media-heavy applications. Tribute, a video platform, documented in a case study how this combination zeroed out their data transfer costs. When your business model involves streaming large files to distributed users, that's not incremental savings. That's a different economic model altogether.
Bunny has been pushing beyond pure CDN territory. Bunny Shield, their WAF and DDoS protection layer, hit general availability last October after processing what the company described as trillions of requests during preview. Magic Containers, an edge compute offering, launched in 2025. Bunny Database, a managed libSQL service compatible with SQLite, debuted this February, followed by an interactive shell in March.
The feature set is catching up. But—and this matters—it's catching up, not caught up. Bunny experienced its own issues, including a Magic Containers deployment problem last June that lasted roughly five hours. The platform is maturing. It isn't mature.
The Counternarrative
Migration isn't a one-way street, which makes the story more interesting. The same quarter that saw the viral "Dropping Cloudflare" post gain traction, Magic Pages—an AI-powered website builder—announced it was moving from Bunny to Cloudflare. Their January rationale was precise and data-driven: measured load times were 40-50% faster on Cloudflare for their specific workload, and they needed more sophisticated WAF capabilities than Bunny currently offers.
This counterexample cuts against the narrative, which is exactly why it's worth examining. Cloudflare's network remains objectively larger. Its DDoS protection has been tested at scales most companies will never see—the company reported mitigating a record DDoS attack of 31.4 terabits per second in late 2025. And for applications that need Workers, R2 object storage, D1 database, and Zero Trust networking all playing nicely together, the platform integration that concerns some developers is precisely what others find indispensable.
Cloudflare reported revenue guidance of $2.785-$2.795 billion for 2026 in their February earnings call, representing 28-29% year-over-year growth. The company highlighted 4.5 million human developers on Workers and rapid growth in AI-agent traffic. Scale brings capabilities that smaller rivals simply can't match, however compelling their pricing.
The migration calculus depends entirely on workload characteristics. Static asset delivery at moderate scale? Bunny's pricing advantage becomes hard to ignore. Dynamic, compute-heavy applications requiring millisecond response times globally? Cloudflare's edge network often wins. The question isn't which CDN is objectively superior. It's which trade-offs matter for your specific use case—and whether you're willing to accept vendor concentration risk to get the capabilities you need.
What Happens When the Middle Disappears
The CDN landscape has consolidated brutally over the past few years. Edgio, formed from the merger of Limelight and Edgecast, filed for bankruptcy in September 2024. Akamai snapped up the assets in November and December of that year, with operations ceasing entirely by January 15, 2025. StackPath exited the CDN business altogether, selling enterprise contracts to Akamai in 2023 before shutting down the following year.
This consolidation created a vacuum—legacy options disappeared faster than new ones could emerge. Akamai's delivery revenue hit $1.257 billion in 2025, but actually declined 5% year-over-year as the company pivoted toward security products. Fastly, another public CDN player, guided 2026 revenue to $700-$720 million—14% growth, but from a much smaller base.
The gap between hyperscale players (Cloudflare, Amazon CloudFront) and everyone else widened. Except it didn't fully close. Developer-first alternatives like Bunny, KeyCDN, and Gcore found traction precisely because they weren't trying to compete on every dimension. They picked their battles: cost transparency, simple pricing, European jurisdiction, straightforward APIs.
Multi-CDN architectures are becoming standard practice at any serious scale. The pattern typically looks like this: one provider for static assets and video (where per-gigabyte costs dominate), another for WAF and DDoS protection (where attack mitigation matters most), and DNS kept separate from both to enable failover. Bunny slots naturally into this architecture as the cost-efficient delivery layer. Not the only layer. Not necessarily even the primary layer for all workloads. But a viable, credible piece of the puzzle.
W3Techs data from this past March still shows Cloudflare's usage share as dominant. But in infrastructure, raw market share tells an incomplete story. Teams need credible alternatives not necessarily to switch tomorrow, but to negotiate better terms and design resilient systems. The existence of viable options changes the power dynamic even for customers who stay put.
The EU Data Act's egress fee ban, taking full effect January 2027, removes friction from experimentation. If testing a new CDN doesn't risk surprise bills when you need to move data back, the switching cost calculation changes fundamentally. Cloudflare and AWS built moats partly through data gravity—the sheer expense and hassle of moving massive datasets created inertia. Regulation is draining that moat, at least within European jurisdiction.
The Unsettling Reality of Security
Research published in March 2025 identified 1,207 WAF bypasses across major providers including AWS, Azure, Cloud Armor, Cloudflare, and ModSecurity. Read that number again: over a thousand documented bypasses. No single vendor's security layer is bulletproof, which means defense in depth increasingly means diversity. And diversity requires viable alternatives that can handle production workloads.
The CDN market's center of gravity is shifting—not from large providers to small ones, but from winner-take-all dynamics to a more nuanced best-tool-for-the-job calculus. Cloudflare will almost certainly remain dominant for integrated edge computing platforms where tight coupling between services matters. Bunny and its peers are carving out territory as the pragmatic choice for teams prioritizing cost transparency, EU jurisdiction, or simply avoiding the risks that come with vendor concentration.
That April blog post resonated not because it revealed some hidden truth, but because it articulated what many infrastructure engineers were already feeling. The outages provided the catalyst. The regulations cleared the path. And the alternatives—Bunny foremost among them—proved viable enough to matter.
In a market projected to grow nearly 10% annually through 2030, there's room for more than one answer to a deceptively simple question: where should our content actually live? The consensus that emerged over the past decade—put it on Cloudflare and move on—is giving way to something messier but possibly more resilient. Perhaps that's progress. Or perhaps it's just what markets look like when they're working properly again.
