Frank
58184008dd
Container images re-resolved against their registries today; each pin is the manifest-list digest the tag answers now, so no container is served from a build that upstream has already replaced. Version-tag moves: authentik 2026.8.3 -> 2026.8.5 (server/worker/outpost and the ldap image, which now carries the tag instead of a bare digest so the pair can never drift apart), seerr v3.4.1 -> v3.5.1, calibre 9.15.0 -> 9.17.0, calibre-web 0.6.27-ls402 -> ls407, plex ls329 -> ls330, tautulli v2.18.1-ls245 -> v2.18.2-ls250. Digest-only moves inside the same stream: postgres 16-alpine, mariadb 11, redis 7-alpine, valkey 9-alpine, grafana, alertmanager, gluetun, searxng, open-webui, jellyfin, romm, chromedp/headless-shell, lightpanda/browser. Rollback is the previous digest on the same Image= line.
39 lines
1.7 KiB
INI
39 lines
1.7 KiB
INI
# Quadlet unit: Chrome DevTools Protocol daemon for the hermes agent (rootless).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/chrome-devtools-protocol.container
|
|
# Unit name: chrome-devtools-protocol.service (container name: chrome-devtools-protocol)
|
|
#
|
|
# Headless Chrome exposing raw CDP over http://127.0.0.1:9222. The hermes
|
|
# agent's chrome-devtools MCP client (mcp_servers.chrome-devtools in
|
|
# /data/config.yaml) spawns npx chrome-devtools-mcp with --browserUrl pointing
|
|
# at this endpoint and drives the browser over it. Both consumers — the Signal
|
|
# gateway and the webui server — run in the host network namespace, so a
|
|
# loopback-only bind is reachable by exactly the processes that may drive the
|
|
# browser and by nobody else on the LAN or WAN.
|
|
#
|
|
# Entrypoint override drops the image's socat front (which would bind
|
|
# 0.0.0.0:9222 in the host namespace and hand browser control to the whole
|
|
# LAN). --no-sandbox is required because rootless podman grants Chrome no user
|
|
# namespace for its sandbox; the content processes therefore run as the uid
|
|
# that already owns this container, capping the blast radius of a hostile page.
|
|
# Image pinned by digest: upgrades are a deliberate unit edit + redeploy, not a
|
|
# tag drift at pull time.
|
|
|
|
[Unit]
|
|
Description=Chrome DevTools Protocol daemon (headless-shell) for hermes
|
|
|
|
[Container]
|
|
ContainerName=chrome-devtools-protocol
|
|
Network=host
|
|
Image=docker.io/chromedp/headless-shell@sha256:7bee201478b2f6266aae01243740ee85c16281e32f42d3aed9fdf04f4eace7a1
|
|
Entrypoint=/headless-shell/headless-shell
|
|
Exec=--no-sandbox --disable-gpu --use-gl=angle --use-angle=swiftshader --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222
|
|
ShmSize=1073741824
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|