Self-hosted caching against commercial delivery — what a Varnish or nginx tier genuinely replaces, what it never will, and the headcount line that decides it.
Winner depends on your workload.
Winner depends on: geography and payroll. A self-hosted Varnish or nginx tier is a superb origin-side cache and a legitimate regional delivery layer for concentrated audiences; it is not a global edge, a scrubbing network, or an on-call bench. The build plan that prices servers but not engineers has already made the classic mistake.
What DIY actually is
The open-source caching stack is genuinely excellent: Varnish's VCL offers request-handling control that only Fastly (which built on it) matches commercially; nginx's proxy_cache is quietly running a measurable share of the internet; Apache Traffic Server carries carrier-scale lineage. Put instances in two or three well-peered locations, front them with the DNS steering we covered in the managed DNS roundup, and you have built a real delivery tier. The comparison with a commercial CDN is therefore not about software quality — it is about everything wrapped around the software.
| Dimension | DIY (Varnish/nginx/ATS) | Commercial CDN |
|---|---|---|
| Footprint | The PoPs you rent and run — realistically 2–10 locations | Hundreds of cities, peering and capacity you could never justify alone |
| Control | Total: your VCL, your kernel, your cache policy, no quota | Bounded by the platform's rules and code tiers |
| DDoS posture | Your bandwidth is the ceiling; a volumetric attack meets your uplink | Multi-Tbps edges absorb what would flatten any DIY tier |
| Cost shape | Servers + transit + engineers — the third line dominates and is always omitted | Per-GB/request pricing that scales down as well as up |
| TLS, certs, protocols | Yours to automate, patch and keep current (HTTP/3, OCSP, PQC timelines) | Platform work you inherit for free |
| On-call | Your pager, at 3 a.m., forever | Their pager, per the tiers we compared in support tiers |
The three honest DIY wins
First, the origin-side cache: a Varnish or nginx tier in front of your application — same rack, same region — is not a CDN alternative at all but a complement that cuts origin compute regardless of what edge sits above it; most estates should run one and many forget to. Second, concentrated geography: if 90% of your audience is in one country, three well-placed DIY PoPs can match a global CDN's latency for that audience at a fraction of the delivered-GB price, especially at volumes where transit is cheap — the same logic that makes private CDNs rational for the Netflixes, scaled down. Third, sovereignty and control: workloads whose caching logic, data handling or compliance posture genuinely cannot live on shared infrastructure.
The three quiet DIY failures
The failure modes are as consistent as the wins. Attack day: the first serious volumetric event finds your transit ceiling, and the emergency migration to a commercial edge happens under fire — the worst possible negotiating posture. Growth day: audience spreads to a region you have no PoP in, and matching a CDN's footprint one rack at a time never catches up. And payroll day: the tier that took one enthusiastic engineer a quarter to build takes a fraction of several engineers forever to run — patching, cert rotation, protocol upkeep, capacity planning — and the moment that engineer leaves, the tier is legacy. Price the build with fully-loaded engineer-fractions or the comparison is fiction; it is the same line item we insist on in what a CDN should cost.
The blended answer
The mature pattern mirrors the rest of this series: DIY where it complements (origin-side caching, always; regional PoPs where geography concentrates and volumes justify), commercial where it protects (the global edge, the DDoS umbrella, the protocol treadmill). And if the motivation is purely price, exhaust the sub-cent commercial field first — at 2026 floor rates, the delivered gigabyte is usually cheaper to buy than to build before the first engineer-hour is counted. Facts verified against provider documentation, July 2026.
Tempted to build — or already running a DIY tier that's become somebody's whole job? The assessment prices build vs buy with the payroll line included.