README.md

metadata

title: Chrome Agent
emoji: 🌍
colorFrom: purple
colorTo: pink
sdk: docker
app_port: 7860
pinned: false

Self-hosted Magentic-UI / MagenticLite — a human-centered multi-agent web/browser automation assistant, pointed at any OpenAI-compatible endpoint. Chromium browser, no stored credentials — the known-working configuration.

Required Space secrets

Secret	Description
OPENAI_BASE_URL	Base URL of an OpenAI-compatible /v1/chat/completions API (vLLM, OpenRouter, your own gateway, etc.).
OPENAI_MODEL	Model id used for both agent roles, unless overridden below.
OPENAI_API_KEY	Bearer token. Passed straight through as an env var to the process — never written into the generated config file.

Optional secrets

Secret	Description
ORCHESTRATOR_MODEL	Model for the orchestrator role (plans, produces the final answer). Defaults to OPENAI_MODEL. Text-only is fine.
WEBSURFER_MODEL	Model for the web-surfer role (drives the browser). Defaults to OPENAI_MODEL. Needs vision support — the browser-use agent reads screenshots. If your model can't do vision, point this at one that can, or set agent_mode: omniagent_only in config.template.yaml to disable browsing entirely.

Architecture notes

• No Quicksand VM sandbox. Magentic-UI normally isolates the browser/code-execution agent inside a lightweight QEMU VM (Quicksand), which needs KVM/nested virtualization — not available on standard HF Spaces hardware. This deployment sets sandbox: type: "null" instead (note: must be the literal string "null" — Magentic-UI's config is a Pydantic Literal["null"], and YAML's unquoted null/None doesn't match it, silently falling back to Quicksand and crashing since quicksand-cua isn't installed in this image). With the sandbox disabled, the agent's browser and code execution run directly in this container, unisolated. This is an explicit, documented Magentic-UI mode ("dev/testing only" per their docs) — reasonable for a single-tenant personal Space, but keep in mind a compromised/prompt-injected page could interact with the container directly.
• No noVNC, but screenshots work. The live-browser-view requirement is partly met: Magentic-UI has a generic browser_screenshot message type that streams periodic screenshots to the chat UI regardless of sandbox type, so you can see what the agent's browser is doing. What you don't get without Quicksand is the smoother continuous noVNC video feed — that's wired specifically to the Quicksand VM's own VNC server, which doesn't exist in the null-sandbox path.
• Internal nginx reverse proxy for the Host-header check. Magentic-UI hardcodes a Host-header allowlist of only localhost/127.0.0.1 (a DNS-rebinding defense) with no config override — so it flatly rejects requests proxied in under this Space's public hostname (Bad Host header, HTTP 400). start.sh runs magentic-ui bound to 127.0.0.1:8081 (not exposed) behind an nginx instance on 0.0.0.0:7860 (the actual exposed port) that rewrites the Host header to localhost before forwarding, including WebSocket upgrade support for the real-time chat stream.
• Runs as a non-root user. Chromium (launched by Playwright, for the browser-use agent) refuses to start as root without --no-sandbox, which Magentic-UI's local browser path doesn't pass. The Dockerfile creates and runs as appuser to sidestep this instead of patching Chromium flags.
• Both model roles are configured as generic OpenAIChatCompletionClients — any server speaking the OpenAI chat completions API works.

History

This Space is a fresh deployment of the same configuration that was previously proven working on Leon4gr45/webagent before that Space got auto-paused by Hugging Face's abuse-detector (a literal process-cmdline match against a since-abandoned Camoufox-based browser swap — unrelated to anything in this Dockerfile). A separate attempt to add a credential-vault feature (stored login/signup secrets so the agent could log in to sites) also got auto-paused, before it even built, by a different (static content-scan) abuse rule — that feature was dropped rather than deployed here. This Space intentionally carries no stored credentials and no browser-engine swap: just plain Playwright-Chromium, the configuration already confirmed to run cleanly end-to-end.