Kernel

Why it's ranked here

Apache 2.0 source for the same images a commercial browser company says powers its hosted product, which is uncommon in this category. The code goes well past a Dockerfile: the Go server wires in screen recording, an outbound-traffic allowlist, scale-to-zero control and optional telemetry export, and the tree carries a long end-to-end suite covering reconnects, Playwright, recording audio and WebMCP. What it does not show is the hosted pitch. Anti-bot handling and fleet autoscaling are not visible in the files read, so those claims rest on the vendor, not on this code.

What's good

The unikernel path is the distinctive part. The README claims cold restarts under 20 milliseconds and a standby mode that snapshots the whole browser, which suits agents that pause for long stretches and need their logged-in state back. The control server publishes its own OpenAPI spec as YAML and JSON, so clients can be generated rather than hand-written. Small operational details live in code: the launcher clears Chromium's stale lock files after a hard kill, waits for the display and window manager before starting, and adds a private-network proxy bypass by default unless one is already set.

Tradeoffs

Self-hosting is not light. The unikernel image needs at least 8 GB of memory, the headless Docker script runs the container privileged with a 2 GB shared-memory mount, and the server exits outside the container because it waits for Chromium's debugging port. On Unikraft the live view gets a public URL that anyone holding it can open, which the README itself flags. Audio over WebRTC is listed as broken. The live-view admin password falls back to "admin" when no environment variable sets it, only one recording runs at a time, and the recording server does not support Windows.

How to use it well

Best for teams that want to run their own agent browsers, or check what a hosted provider actually runs, and are already comfortable with Docker or Unikraft Cloud. Point an existing Playwright or Puppeteer script at the exposed debugging port and keep the rest of the code unchanged. Use the read-only live view for anything a human should only watch, set your own admin password, and delete unikernel instances when done since their URLs are public. If the need is a managed fleet with stealth and scaling handled for you, this repository is the engine, not the service.

Observed

License

Apache License 2.0

Language

Go control server; Chromium browser images

Packaging

Headful and headless Docker images, plus Unikraft unikernel builds

Interfaces

Chrome DevTools Protocol on port 9222; REST API with an embedded OpenAPI spec; noVNC or WebRTC live view

Platform support

Recording server supports macOS and Linux; Windows not supported (server/README.md)

Memory requirement

Unikernel image needs at least 8 GB (README.md)

Tests

End-to-end test directory in the tree, run with testcontainers-go against pre-built images

Hosted features

Anti-bot handling and autoscaling are not described in the files read

Known limitation

README lists WebRTC audio streaming as non-functional