Reapply: browser_brave/browser_chromium: make Chrome devtools port 9221 reachable (#3189) (#3196)

* Reapply "browser_brave/browser_chromium: make Chrome devtools port 9221 reachable (#3189) (#3194)"

#3194 was reverted by the builder's revert-on-failure job because the
image builds hit lscr.io 429 Too Many Requests while pulling the LSIO
base images, not because of the diff (its PR build tests passed).
Reapplied verbatim.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* browser_brave/browser_chromium: blank line after CHANGELOG heading (markdownlint MD022/MD032)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* browser_chromium: do not enable devtools proxy in standalone mode

The standalone bashio shim returns the port number itself when no
override is set, so the 9221 check enabled the proxy unconditionally
outside Supervisor. Require bashio::supervisor.ping, as 00-banner.sh does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

browser_brave/CHANGELOG.md

@@ -1,3 +1,7 @@
+
+## 1.98.63-ls143.1 (04-11-2026)
+
+- Fix Chrome devtools port 9221 not reachable from outside the container: the browser only binds 127.0.0.1, so it now listens on 9222 and nginx exposes it on 9221 only when that port is mapped (#3189)
  
 ## 1.98.63-ls143 (2026-10-31)
 - Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)

browser_brave/Dockerfile

@@ -45,7 +45,7 @@ RUN \
     if [[ -d /etc/services.d ]] && ls /etc/services.d/*/run 1> /dev/null 2>&1; then sed -i "1a set +e" /etc/services.d/*/run; fi
 
 # Modify commands
-RUN sed -i '/no-first-run/a\  --remote-debugging-address=0.0.0.0 --remote-debugging-port=9221 \\' /usr/bin/wrapped-*
+RUN sed -i '/--password-store=basic/a\  --remote-debugging-port=9222 \\' /usr/bin/wrapped-*
 
 # Global LSIO modifications
 COPY ha_lsio.sh /ha_lsio.sh

browser_brave/config.yaml

@@ -69,5 +69,5 @@ slug: brave
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.98.63-ls143"
+version: "1.98.63-ls143.1"
 video: true

browser_chromium/CHANGELOG.md

@@ -1,3 +1,8 @@
+
+## 2026.10.31.1 (04-11-2026)
+
+- Fix Chrome devtools port 9221 not reachable from outside the container: the browser only binds 127.0.0.1, so it now listens on 9222 and nginx exposes it on 9221 only when that port is mapped (#3189)
+- Fix devtools flag never being added to the LSIO chromium wrapper
  
 ## 2026.10.31 (2026-10-31)
 - Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)

browser_chromium/Dockerfile

@@ -45,7 +45,7 @@ RUN \
     if [[ -d /etc/services.d ]] && ls /etc/services.d/*/run 1> /dev/null 2>&1; then sed -i "1a set +e" /etc/services.d/*/run; fi
 
 # Modify commands
-RUN sed -i '/no-first-run/a\  --remote-debugging-address=0.0.0.0 --remote-debugging-port=9221 \\' /usr/bin/wrapped-*
+RUN sed -i '/--password-store=basic/a\  --remote-debugging-port=9222 \\' /usr/bin/wrapped-*
 
 ENV GLOBAL_VAR_FILES="/etc/usr/bin/wrapped-chromium"
 

browser_chromium/config.yaml

@@ -71,5 +71,5 @@ slug: chromium
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2026.10.31"
+version: "2026.10.31.1"
 video: true

browser_chromium/rootfs/etc/cont-init.d/90-ingress.sh

@@ -27,3 +27,9 @@ sed -i "s|SUBFOLDER|${SUBFOLDER}|g" "${NGINX_CONFIG}"
 
 # Enable ingress
 cp "${NGINX_CONFIG}" /etc/nginx/sites-enabled
+
+# Expose Chrome devtools only when its port is mapped (Supervisor only: the
+# standalone shim reports every port as mapped)
+if bashio::supervisor.ping 2>/dev/null && [[ -n "$(bashio::app.port "9221")" ]]; then
+    cp /etc/nginx/sites-available/devtools.conf /etc/nginx/sites-enabled
+fi

browser_chromium/rootfs/etc/nginx/sites-available/devtools.conf

@@ -0,0 +1,15 @@
+# Chrome devtools: the browser only binds 127.0.0.1 when not headless,
+# so expose it on 9221 through nginx (enabled by 90-ingress.sh when mapped)
+server {
+    listen 9221;
+
+    location / {
+        proxy_pass http://127.0.0.1:9222;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+}

browser_chromium/rootfs/etc/usr/bin/wrapped-chromium

@@ -27,8 +27,7 @@ seccomp_mode="$(awk -F':' '/^Seccomp:/{gsub(/[[:space:]]/,"",$2); print $2}' /pr
 
 # Base arguments (exactly what you requested + required safety flags)
 args=(
-  --remote-debugging-address=0.0.0.0
+  --remote-debugging-port=9222
-  --remote-debugging-port=9221
   --user-data-dir="${USER_DATA_DIR}"
   --disable-dev-shm-usage
   --no-first-run