Lightpanda #2520

Name of the Script

Lightpanda

Script Type

CT (LXC Container)

Script path

No response

Where does it run?

None

Does this script support arm64?

arm64 supported

Tested on

• Proxmox VE
• Incus

📋 Script Details

New script for Lightpanda, a headless browser built from scratch (Zig + V8) for AI agents and automation. It speaks CDP, so Puppeteer and Playwright connect to it like they would to Chrome, and it ships a built-in MCP server.

What the script does:

Installs the official .deb from GitHub releases with fetch_and_deploy_gh_release ... "binary". The package is just /usr/bin/lightpanda, no service, so the script adds two units.
lightpanda.service: CDP server on 9222. Same flags as upstream's Docker CMD (serve --host 0.0.0.0 --port 9222 --log-level info) plus --advertise-host ${LOCAL_IP}. Without it /json/version hands out ws://127.0.0.1:9222, so connectOverCDP('http://:9222') from another machine dials itself. Lightpanda logs a warning about exactly this when bound to 0.0.0.0. If the container IP changes later, ws://:9222 still connects (IP literals are always accepted), only the discovery URL goes stale.
lightpanda-mcp.service: MCP over HTTP on 9223 (lightpanda mcp --host 0.0.0.0 --port 9223), so agents on the LAN can use it at http://:9223/mcp.
Sets LIGHTPANDA_DISABLE_TELEMETRY=true on both. Upstream sends usage telemetry by default (README, "Telemetry").
Passes --block-private-networks to both. Neither server has auth, and an agent can be steered by what's on the page, so without it anything on the LAN opens through the container. Checked on my host: the Proxmox UI answers 200 to curl from inside the container, and Lightpanda fails on it with CouldntConnect once the flag is on, while public sites still work. Remove the flag to browse internal sites, the second JSON note says so.
Update checks the GitHub release and redeploys the .deb. No data to keep, nothing is stored.
Where this came from: read the upstream README (install, serve, MCP, telemetry sections) and the Dockerfile. The runtime stage there is only the binary + tini on debian:stable-slim, tini is just for PID 1 signal handling, so systemd covers it. The .deb only depends on libc6 (>= 2.35), so no extra packages.

#2465