From 2404e1996da3737526bde24dbd3bad389cfcd4d7 Mon Sep 17 00:00:00 2001 From: Aditya Raj Singh Date: Sat, 24 Oct 2026 00:04:56 +0530 Subject: [PATCH 1/2] New Script: Lightpanda LXC --- ct/lightpanda.sh | 60 +++++++++++++++++++++++++++++++++++ install/lightpanda-install.sh | 56 ++++++++++++++++++++++++++++++++ json/lightpanda.json | 43 +++++++++++++++++++++++++ 3 files changed, 159 insertions(+) create mode 100644 ct/lightpanda.sh create mode 100644 install/lightpanda-install.sh create mode 100644 json/lightpanda.json diff --git a/ct/lightpanda.sh b/ct/lightpanda.sh new file mode 100644 index 0000000000..78c853b2ed --- /dev/null +++ b/ct/lightpanda.sh @@ -0,0 +1,60 @@ +#!/usr/bin/env bash +_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/DevScripts/main" +_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func" +source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func") + +# Copyright (c) 2021-2026 community-scripts ORG +# Author: Aditya Raj Singh (justadityaraj) +# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE +# Source: https://lightpanda.io/ + +APP="Lightpanda" +var_tags="${var_tags:-browser;automation;ai}" +var_cpu="${var_cpu:-1}" +var_ram="${var_ram:-1024}" +var_disk="${var_disk:-4}" +var_os="${var_os:-debian}" +var_version="${var_version:-13}" +var_unprivileged="${var_unprivileged:-1}" +#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified + +header_info "$APP" +variables +color +catch_errors + +function update_script() { + header_info + check_container_storage + check_container_resources + + if [[ ! -f /usr/bin/lightpanda ]]; then + msg_error "No ${APP} Installation Found!" + exit + fi + + if check_for_gh_release "lightpanda" "lightpanda-io/browser"; then + msg_info "Stopping Lightpanda" + systemctl stop lightpanda lightpanda-mcp + msg_ok "Stopped Lightpanda" + + fetch_and_deploy_gh_release "lightpanda" "lightpanda-io/browser" "binary" + + msg_info "Starting Lightpanda" + systemctl start lightpanda lightpanda-mcp + msg_ok "Started Lightpanda" + msg_ok "Updated successfully!" + fi + exit +} + +start +build_container +description + +msg_ok "Completed Successfully!\n" +echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}" +echo -e "${INFO}${YW}Connect Puppeteer or Playwright to the CDP server:${CL}" +echo -e "${GATEWAY}${BGN}ws://${IP}:9222${CL}" +echo -e "${INFO}${YW}Connect an AI agent to the MCP server:${CL}" +echo -e "${GATEWAY}${BGN}http://${IP}:9223/mcp${CL}" diff --git a/install/lightpanda-install.sh b/install/lightpanda-install.sh new file mode 100644 index 0000000000..ec1ffaa3c8 --- /dev/null +++ b/install/lightpanda-install.sh @@ -0,0 +1,56 @@ +#!/usr/bin/env bash + +# Copyright (c) 2021-2026 community-scripts ORG +# Author: Aditya Raj Singh (justadityaraj) +# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE +# Source: https://lightpanda.io/ + +source /dev/stdin <<<"$FUNCTIONS_FILE_PATH" +color +verb_ip6 +catch_errors +setting_up_container +network_check +update_os + +fetch_and_deploy_gh_release "lightpanda" "lightpanda-io/browser" "binary" + +msg_info "Creating Services" +cat </etc/systemd/system/lightpanda.service +[Unit] +Description=Lightpanda CDP Server +After=network.target + +[Service] +Type=simple +User=root +Environment=LIGHTPANDA_DISABLE_TELEMETRY=true +ExecStart=/usr/bin/lightpanda serve --host 0.0.0.0 --advertise-host ${LOCAL_IP} --port 9222 --log-level info +Restart=on-failure +RestartSec=5 + +[Install] +WantedBy=multi-user.target +EOF +cat </etc/systemd/system/lightpanda-mcp.service +[Unit] +Description=Lightpanda MCP Server +After=network.target + +[Service] +Type=simple +User=root +Environment=LIGHTPANDA_DISABLE_TELEMETRY=true +ExecStart=/usr/bin/lightpanda mcp --host 0.0.0.0 --port 9223 +Restart=on-failure +RestartSec=5 + +[Install] +WantedBy=multi-user.target +EOF +systemctl enable -q --now lightpanda lightpanda-mcp +msg_ok "Created Services" + +motd_ssh +customize +cleanup_lxc diff --git a/json/lightpanda.json b/json/lightpanda.json new file mode 100644 index 0000000000..9c1df32a61 --- /dev/null +++ b/json/lightpanda.json @@ -0,0 +1,43 @@ +{ + "name": "Lightpanda", + "slug": "lightpanda", + "categories": [20], + "date_created": "2026-10-23", + "type": "ct", + "updateable": true, + "privileged": false, + "interface_port": 9222, + "documentation": "https://lightpanda.io/docs", + "website": "https://lightpanda.io/", + "repository": "https://github.com/lightpanda-io/browser", + "logo": "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/webp/lightpanda.webp", + "description": "Lightpanda is a headless browser built from scratch for AI agents and automation. It runs JavaScript and speaks the Chrome DevTools Protocol, so Puppeteer and Playwright scripts work against it, and it has a built-in MCP server for AI agents.", + "install_methods": [ + { + "type": "default", + "script": "ct/lightpanda.sh", + "config_path": "", + "resources": { + "cpu": 1, + "ram": 1024, + "hdd": 4, + "os": "Debian", + "version": "13" + } + } + ], + "default_credentials": { + "username": null, + "password": null + }, + "notes": [ + { + "text": "Neither server has authentication. Anyone who can reach ports 9222 and 9223 can browse the web through this container, so keep it on a trusted network.", + "type": "warning" + }, + { + "text": "Connect Puppeteer or Playwright to ws://:9222. Add http://:9223/mcp to your AI agent as an HTTP MCP server.", + "type": "info" + } + ] +} From 6e318d5d3023385b9c9364e5e8093e8e8fc3e417 Mon Sep 17 00:00:00 2001 From: Aditya Raj Singh Date: Sat, 24 Oct 2026 12:03:25 +0530 Subject: [PATCH 2/2] Lightpanda: block private networks by default Both servers are unauthenticated and an agent driving them can be steered by page content. Without the flag the container can open any service on the LAN; with it, requests resolving to private or internal IPs fail. Users who need internal sites remove the flag from the two unit files. --- install/lightpanda-install.sh | 4 ++-- json/lightpanda.json | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/install/lightpanda-install.sh b/install/lightpanda-install.sh index ec1ffaa3c8..fb5aefdace 100644 --- a/install/lightpanda-install.sh +++ b/install/lightpanda-install.sh @@ -25,7 +25,7 @@ After=network.target Type=simple User=root Environment=LIGHTPANDA_DISABLE_TELEMETRY=true -ExecStart=/usr/bin/lightpanda serve --host 0.0.0.0 --advertise-host ${LOCAL_IP} --port 9222 --log-level info +ExecStart=/usr/bin/lightpanda serve --host 0.0.0.0 --advertise-host ${LOCAL_IP} --port 9222 --log-level info --block-private-networks Restart=on-failure RestartSec=5 @@ -41,7 +41,7 @@ After=network.target Type=simple User=root Environment=LIGHTPANDA_DISABLE_TELEMETRY=true -ExecStart=/usr/bin/lightpanda mcp --host 0.0.0.0 --port 9223 +ExecStart=/usr/bin/lightpanda mcp --host 0.0.0.0 --port 9223 --block-private-networks Restart=on-failure RestartSec=5 diff --git a/json/lightpanda.json b/json/lightpanda.json index 9c1df32a61..ff21301a0b 100644 --- a/json/lightpanda.json +++ b/json/lightpanda.json @@ -38,6 +38,10 @@ { "text": "Connect Puppeteer or Playwright to ws://:9222. Add http://:9223/mcp to your AI agent as an HTTP MCP server.", "type": "info" + }, + { + "text": "Requests to private and internal IPs are blocked so an agent can't be steered into your LAN. Remove --block-private-networks from both service files to browse internal sites.", + "type": "info" } ] }