Chromium DevTools bind behavior (remote debugging)

Scope

This note documents Chromium/Chrome behavior for DevTools HTTP remote debugging bind address.

This is intentionally about Chromium behavior itself, not Playwright run-server wrapper behavior.

Findings

1. Chromium DevTools HTTP server is implemented to bind localhost by default in both major code paths:

   • Chrome browser path: chrome/browser/devtools/remote_debugging_server.cc
     • source.chromium.org: remote_debugging_server.cc
   • Headless shell path: headless/lib/browser/headless_devtools.cc
     • source.chromium.org: headless_devtools.cc

2. In both files, the socket factory tries:

   • 127.0.0.1
   • then ::1

3. The headless implementation has no handling for --remote-debugging-address in this path.

4. --remote-debugging-address was a real/legit Chromium flag historically, but support was intentionally removed in old headless:

   • Commit: 6fee475feb9bc9aaded8f9b6443d18edb22de86b
     • chromium.googlesource: commit 6fee475
   • Patch: 6fee475feb9bc9aaded8f9b6443d18edb22de86b^!
     • chromium.googlesource: patch 6fee475^!
   • Subject: [headless] Remove --remote-debugging-address support from old headless
   • Rationale from commit message: unprotected remote access to CDP was considered too dangerous.

5. Practical runtime observation (container):

   • /proc/net/tcp showed 0100007F:240D while debugging (240D = 9229), i.e. listener bound to 127.0.0.1:9229.
   • curl http://127.0.0.1:9229/json/list worked inside container.
   • Host access via Docker bridge port publishing for 9229 failed/reset.

Conclusion

For this Chromium execution path, DevTools remote debugging endpoint is loopback-bound in practice.

As a result, bridge-mode Docker ports: "9229:9229" is not sufficient unless traffic can reach container loopback (which it normally cannot).

network_mode: host works because loopback binding becomes reachable from host namespace.

Historically, this was not a hallucination: the address flag existed, but Chromium tightened behavior and removed support in relevant headless paths.

Also, Chromium CLI parsing is generally permissive, so unsupported/ignored switches are often not hard-rejected by startup.

Evidence pointers

• Chromium source:
  • chrome/browser/devtools/remote_debugging_server.cc
    • source.chromium.org: remote_debugging_server.cc
  • headless/lib/browser/headless_devtools.cc
    • source.chromium.org: headless_devtools.cc
  • removal commit: 6fee475feb9bc9aaded8f9b6443d18edb22de86b
    • chromium.googlesource: commit 6fee475
• Runtime check:
  • /proc/net/tcp entry 0100007F:240D
  • curl http://127.0.0.1:9229/json/list (inside container)