Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRun a browser automation service as a private, containerized service, then connect your AI agent to it with Playwright or Puppeteer over the service’s WebSocket/CDP interface. Start with one authenticated, concurrency-limited container; keep it off the public internet; and add health checks, queue controls, monitoring, and orchestration before sending production traffic. You gain control over where browser sessions and page data run, but take responsibility for browser updates, capacity, and failure recovery.
What you are self-hosting
A self-hosted browser automation service is a browser fleet running in infrastructure you control. Your agent decides what task to perform; an application layer turns that decision into bounded browser operations; and a browser service starts and manages browser sessions. A Browserless container, for example, provides browser automation interfaces for Playwright, Puppeteer, and REST jobs.
The agent should not get unrestricted access to a browser server. Keep the model-facing tools narrow—such as navigate to an allowed site, inspect a page, click a known control, or capture a screenshot—and let application code enforce domain rules, timeouts, and data handling. The browser service executes those operations; it does not replace the agent’s policy or application logic.
Reference architecture
- Agent and application: The agent selects a task and calls deterministic tools exposed by your application.
- Automation client: Playwright or Puppeteer performs navigation, locator, click, form, download, or screenshot operations.
- Browser service: A containerized service starts and manages browser sessions and exposes WebSocket/CDP and REST interfaces.
- Control plane: Authentication, token roles where available, concurrency limits, queue behavior, timeouts, health checks, and session cleanup constrain access and resource use.
- Infrastructure: A single container or Compose deployment can suit a small service; Kubernetes and health-aware load balancing are options when you need multiple workers and failure recovery.
Choose self-hosting when the boundary matters
Self-hosting is useful when session data, screenshots, or scraped page content must stay within infrastructure you control, or when the browser needs access to private network resources. Browserless describes its self-hosted offering as supporting VPC, on-premises, and air-gapped deployments. That makes this model relevant to data-locality and custom network-policy requirements; it does not by itself make an application compliant with a particular regulation.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
The trade-off is operational ownership. Browser processes use CPU and RAM, concurrent sessions compete for them, browser instances can accumulate memory use, and images need security updates. You must plan capacity and respond to queue buildup, worker failure, and browser vulnerabilities. The source material does not establish a universal CPU/RAM-per-session figure, so size from your own workload and observed limits rather than copying a generic ratio.
Self-hosted and managed are different operating models
| Decision | Self-hosted service | Managed browser service |
|---|---|---|
| Data boundary | Runs in your VPC, on-premises environment, or other controlled network. | Runs in a third-party provider’s environment; verify the service’s data handling and network options. |
| Operations | You own browser patching, scaling, queueing, health checks, and incident response. | The provider operates the browser infrastructure; check what remains your responsibility. |
| Protocol fit | Useful when retaining Playwright or Puppeteer clients over WebSocket/CDP, or using REST jobs. | Depends on the provider’s protocols and APIs. |
| Capacity and cost | You provision owned capacity and manage bursts. | Capacity and billing depend on the provider. The available Browserless source material does not provide comparable prices. |
Browserless materials distinguish its core self-hosted automation from enterprise capabilities such as stealth, CAPTCHA solving, and BrowserQL. Verify current licensing and feature availability directly before relying on any of those capabilities; do not assume they are part of every image or plan.
Deploy a first private container
Use a pinned image tag, not a floating latest tag, so a deployment can be reproduced and rolled back. Browserless documents open-source images for Chromium, Chrome, Firefox, WebKit, Edge, and a multi-browser option; Chrome and Edge availability has architecture limits. Select an image compatible with your runtime architecture, then record the exact image and tag you deploy.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
The quickstart’s configuration uses Docker port mapping plus TOKEN and CONCURRENT environment variables. The source material does not specify an image reference, port, or universally correct concurrency number, so obtain the compatible image name, container port, and supported value ranges from the current Browserless documentation for your chosen image. This Compose template makes those deployment-specific values explicit rather than guessing them.
services:
browser:
image: ${BROWSER_IMAGE:?Set a pinned Browserless image and tag}
environment:
TOKEN: ${BROWSER_TOKEN:?Set a long, private token}
CONCURRENT: ${BROWSER_CONCURRENT:?Set a conservative session limit}
ports:
- "${BROWSER_HOST_PORT:?Set a host port}:${BROWSER_CONTAINER_PORT:?Set the image's documented port}"
restart: unless-stoppedSet the variables in your deployment environment or an access-controlled environment file. Do not commit the token file to source control. For a local test, bind the published port to loopback or place the service on a private container network rather than publishing it on a public interface. The exact host firewall and Compose network configuration depend on where the agent runs.
Bring it up and check it
- Choose the browser image and tag for your architecture, and set
BROWSER_IMAGEto that exact reference. - Set the documented container port and an available host port in
BROWSER_CONTAINER_PORTandBROWSER_HOST_PORT. - Generate a strong secret for
BROWSER_TOKEN; configure a low initialBROWSER_CONCURRENTvalue appropriate for a test deployment. - Start the service with
docker compose up -d, then inspect startup output withdocker compose logs -f browser. - From the agent’s network, verify that the service is reachable only where intended and that an unauthenticated request cannot use its endpoints. Test an authenticated browser connection using the WebSocket/CDP endpoint format documented for your selected image.
For production, put the service behind private networking and restrict ingress to the application or agent network. Use TLS at the boundary if traffic crosses hosts or an untrusted network. Store secrets in your deployment platform’s secret store where available; rotate tokens when access changes or a secret may have been exposed.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Connect Playwright or Puppeteer
You can usually keep the automation client and move browser execution to the private service. The client must use the WebSocket/CDP endpoint and authentication format documented for the particular Browserless image and interface. Endpoint paths and connection options vary, so copy the full endpoint from the matching documentation or deployment rather than assuming one URL works for every image.
For a JavaScript application using Playwright, configure the endpoint and token outside the source file. This example uses Playwright’s CDP connection method; use the connection method matching the protocol exposed by your service.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchimport { chromium } from "playwright";
const endpoint = process.env.BROWSER_WS_ENDPOINT;
if (!endpoint) throw new Error("Set BROWSER_WS_ENDPOINT to the documented service endpoint");
const browser = await chromium.connectOverCDP(endpoint);
try {
const context = await browser.newContext();
const page = await context.newPage();
page.setDefaultNavigationTimeout(30_000);
await page.goto("https://example.com", { waitUntil: "domcontentloaded" });
console.log(await page.title());
await page.screenshot({ path: "page.png", fullPage: true });
await context.close();
} finally {
await browser.close();
}Install the Playwright package in the application environment and ensure the browser protocol and browser family agree. If your Browserless connection uses Puppeteer or a different Playwright connection method, follow that image’s documented client example instead. Do not put a production token in source code or pass it to the model as free-form text.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Keep sessions bounded
- Set navigation and overall task timeouts so a stalled page cannot hold a worker indefinitely.
- Close pages, contexts, and sessions on success, error, or cancellation. Use
finally-style cleanup in application code. - Cap the number of concurrent sessions at the service and application layers; reject or queue excess work deliberately.
- Use an allowlist or policy layer for destinations when agents should not browse arbitrary URLs.
- Treat page text, downloads, and browser output as untrusted input. Do not expose control-plane credentials to the browser process or to page content.
Choose WebSocket/CDP or REST for the job
Use a persistent Playwright or Puppeteer connection when a task needs several coordinated interactions: authenticate to a portal, navigate a sequence of pages, fill a multi-step form, or retain page state while the agent works. This preserves the familiar browser-client model, but makes session lifetime, cleanup, and concurrency especially important.
Use REST when the work is stateless and request-shaped, such as capturing a screenshot or PDF, scraping a page, or extracting content. Browserless documents REST interfaces for these jobs. They can be easier to queue and retry than a long-lived interactive session, but confirm the exact endpoint, request schema, and limits for the image you deploy.
A real browser is warranted when the target site requires rendered JavaScript or human-oriented interaction. If a stable API already supplies the data or action, prefer that API: it is usually simpler to constrain and operate than an agent-driven browser session.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Secure the service before production
Authentication is not optional. Browserless explicitly warns that if TOKEN is omitted, endpoints are unauthenticated, including /function, which can execute arbitrary Puppeteer code supplied in a request body. Never expose an unset-token deployment beyond localhost or a tightly controlled private network.
Deployment security checklist
- Require a token: Set
TOKENand verify access control before routing agent traffic. - Restrict ingress: Permit connections only from the application network; do not publish a powerful browser endpoint to the public internet by default.
- Separate access: Use distinct credentials for development, CI, and production. Browserless enterprise documentation describes token roles for endpoint scoping; check availability and configuration for your edition.
- Limit impact: Set concurrency and session-duration limits, and make queue behavior explicit so runaway agents cannot consume the fleet without bound.
- Protect secrets: Keep browser tokens and application credentials out of prompts, logs, page content, and downloaded files.
- Isolate workers: Treat visited sites and downloaded content as hostile. Do not give a browser worker unnecessary access to internal services or control-plane secrets.
- Patch deliberately: Track browser and container image updates, test them, and roll forward or back through pinned image tags.
- Encrypt cross-host traffic: Use TLS at the network boundary when browser-client traffic crosses hosts.
Operate it reliably as load grows
One container is a useful starting point, not a complete production design. The next steps are observability, health-aware routing, controlled queueing, and a recovery plan. Compose can organize a small deployment; Kubernetes and health-aware load balancing become relevant when you need multiple workers, rescheduling, or failure recovery. Orchestration cannot make an overloaded browser fleet healthy by itself: monitor resource pressure and control admission to the queue.
What to monitor
- Active sessions and queued requests relative to the configured concurrency limit.
- Session duration, navigation timeouts, failed connections, and task cancellation.
- Container restarts, worker health, and CPU and memory trends over time.
- Browser and image versions, update rollout status, and rollback readiness.
Exact resource sizing is workload-specific and no neutral universal capacity figure is established here. Measure representative pages and agent workflows in your own environment, include bursts and slow destinations, and set limits from observed resource use with headroom for failures. Treat repeated queue growth or rising memory as a capacity or cleanup problem to investigate, not as a reason to remove limits.
Plan for retries and partial failure
A browser task can fail after navigation has begun or after a form submission has reached the site. Do not blindly retry actions that may have side effects. Make application operations idempotent where possible, distinguish connection failures from page-level results, and record enough structured context to diagnose failures without logging secrets or sensitive page contents. During deployment, drain or stop accepting new tasks before replacing workers, then allow active sessions to finish or cancel them under a defined timeout.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot common failures
| Symptom | Likely cause | What to check or change |
|---|---|---|
| Connection is refused or times out | The host port, container port, network route, or service health is wrong. | Confirm the image’s documented container port, Compose mapping, container logs, and that the client is on an allowed network. |
| Unauthorized response or rejected connection | The token is missing, incorrect, or passed in the wrong documented form. | Check the service token configuration and the endpoint’s authentication format without printing the secret to logs. |
| Client connects but browser operations fail | The protocol or client method does not match the service interface, or the browser family is incompatible. | Use the connection method and browser image documented for that interface; verify architecture support for the selected image. |
| Requests wait or are rejected under load | The concurrency cap has been reached or sessions are not being cleaned up. | Inspect active sessions and queue behavior, ensure all code paths close contexts and connections, then adjust capacity based on measured resource use. |
| Tasks stall on navigation | The target page is slow, a wait condition never occurs, or an agent task lacks a deadline. | Use bounded navigation and task timeouts, select an appropriate readiness condition, and handle timeout as a task failure with cleanup. |
| Container restarts or becomes slow over time | Resource pressure, long-lived sessions, or browser memory growth may be involved. | Review memory and CPU trends, session lifetime, concurrency, and image health; reproduce with representative workloads before changing limits. |
| Browser endpoint is reachable from outside the intended network | Port publishing or firewall rules are broader than intended. | Remove public ingress, bind locally for local tests, and allow only the agent/application network; require authentication regardless. |
Or skip the browser setup
If your agent only needs a website screenshot or PDF—not an interactive browser session—ScreenshotNeo is a simpler API option. It is not a replacement for a self-hosted Playwright/Puppeteer browser fleet. One GET request returns a screenshot or PDF, and the API can remove cookie/consent banners, newsletter popups, and chat widgets before capture. Its response identifies page verdict and billing status; bot checks, blank pages, timeouts, failed loads, and cache hits are not billed. It also offers an MCP server for AI agents.
For example, save a screenshot as WebP with cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for authentication and capture options. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Sign up for the free plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
