jssh vs Cloudflare Tunnel
Cloudflare Tunnel for device fleets: great plumbing, missing product
When to choose Cloudflare Tunnel: You have a handful of your own servers, your domain is already on Cloudflare, and you are comfortable assembling access policies, DNS records and audit yourself. For that case cloudflared is free, solid and widely deployed.
Up front: jssh runs its relay on Cloudflare’s edge. We think their network is the best place to run one. This comparison is about the distance between a connectivity primitive and a fleet operations product.
What you assemble yourself
With Cloudflare Tunnel, SSH access to one device means a domain on Cloudflare, a DNS record per
device, an Access application and policies, and cloudflared on the box. It works. Now multiply by
a fleet:
| Fleet need | Cloudflare Tunnel | jssh |
|---|---|---|
| Device inventory (what is online, where, which version) | Build it yourself | Built in |
| Enrollment at scale | Script DNS and tunnel credentials per device | One enrollment token pushed through your own tooling; the device names itself |
| Per-session SSH audit (who, which device, duration) | Assemble from Access logs | Built in, per session, on every plan |
| Isolating the fleets of different customers | One Cloudflare account or zone per customer, manually | Separate organizations, on every plan |
| Requires owning a domain | Yes. One DNS record per device, which you script | No domain needed |
| Small or odd hardware (OpenWrt routers, ARM gateways) | No official ARMv6 build | Static musl binary; x86_64 through ARMv7 validated, ARMv6 published and not yet run on real silicon |
| Price | Free for the basics; per-user for Zero Trust features | Unlimited devices on any paid plan; priced on concurrent sessions |
None of these gaps is a criticism of Tunnel. They are out of its scope. It was built to publish your services from your infrastructure, and for that it is excellent. A fleet of devices on other people’s networks, owned by your customers, and reached under audit obligations, is a different product category.
The hardware gap is structural
cloudflared publishes no official ARMv6 build, which rules out the Raspberry Pi Zero and Pi 1 and
a long tail of industrial gateways and routers where fleets live. Someone asked for one on
Cloudflare’s community forum, and the reply points at unofficial third-party builds.
Source: Cloudflare Community, “There aren’t any release support raspberry zero”, 10 June 2024 (archived 25 July 2024). The live thread returns HTTP 403 to automated fetchers, which is why the archived copy is linked beside it.
The jssh agent is a static Rust binary, about 4 MB on ARM and about 5 MB on x86_64, and the Linux
builds link musl statically, so the device’s own libc is irrelevant. Our validated coverage today
runs from ARMv7 up (x86_64, aarch64, ARMv7, plus OpenWrt and Ubuntu Core), and we publish an ARMv6
build (arm-unknown-linux-musleabihf) that we have not yet exercised on real ARMv6 silicon. If
ARMv6 is on your bill of materials, tell us and we will validate on your board before you commit.
The honest cost comparison
Tunnel’s basics are free, and if your fleet is five of your own boxes, free wins, so use it. The cost appears at fleet scale as engineering time: the inventory dashboard, the enrollment pipeline, the audit assembly, the isolation between customers. That is the product you would be building and maintaining instead of us.
Last reviewed .