Summary: the CDP server is hardcoded to bind 127.0.0.1 and cmd/foxbridge has no flag to change it — even though pkg/cdp/server.go already exposes Server.SetHost(), nothing wires it.
Why it matters: a CDP client running on the host cannot reach foxbridge running in a container with normal bridge networking + -p port publishing: docker-proxy connects to the container's bridge IP, not its loopback, so the connection is silently closed. The only workaround today is --network host, which shares the host network namespace with the container (a compromised container can bind/connect anywhere on the host) — worse isolation for exactly the sidecar use case.
Fix (implemented in https://github.com/lgwacker/foxbridge, commit d50f813): add a --host flag (default 127.0.0.1, preserving upstream behaviour) and always call server.SetHost(*host). With --host 0.0.0.0 the bridge-networked container is reachable through loopback-only -p 127.0.0.1:9222:9222, keeping the same isolation model as a --network host-free deployment.
Evidence: foxbridge --host 0.0.0.0 inside a bridge-networked container is reachable through -p (GET /json/version returns webSocketDebuggerUrl), validated end-to-end (navigation + evaluate) with Camoufox.
This is also the item behind the "release binaries / container support" direction — happy to turn the fork commit into a PR if useful.
Summary: the CDP server is hardcoded to bind
127.0.0.1andcmd/foxbridgehas no flag to change it — even thoughpkg/cdp/server.goalready exposesServer.SetHost(), nothing wires it.Why it matters: a CDP client running on the host cannot reach foxbridge running in a container with normal bridge networking +
-pport publishing: docker-proxy connects to the container's bridge IP, not its loopback, so the connection is silently closed. The only workaround today is--network host, which shares the host network namespace with the container (a compromised container can bind/connect anywhere on the host) — worse isolation for exactly the sidecar use case.Fix (implemented in https://github.com/lgwacker/foxbridge, commit
d50f813): add a--hostflag (default127.0.0.1, preserving upstream behaviour) and always callserver.SetHost(*host). With--host 0.0.0.0the bridge-networked container is reachable through loopback-only-p 127.0.0.1:9222:9222, keeping the same isolation model as a--network host-free deployment.Evidence:
foxbridge --host 0.0.0.0inside a bridge-networked container is reachable through-p(GET /json/versionreturnswebSocketDebuggerUrl), validated end-to-end (navigation + evaluate) with Camoufox.This is also the item behind the "release binaries / container support" direction — happy to turn the fork commit into a PR if useful.