An anti-detect browser in one docker run
Pull the official image and you have a Clearcote browser listening on a CDP port. Point Playwright, Puppeteer, browser-use, Crawl4AI or Stagehand at it and your code stays as it is. The image launches the binary directly, without the automation switch, so navigator.webdriver stays false.
The image runs the open build with no key. Add a free GitHub key for the latest build.
Run it, attach to it
# CDP on http://localhost:9222, published to this host only
docker run -d --rm -p 127.0.0.1:9222:9222 --shm-size=1g teamflatearth/clearcoteHighlights
A verified binary, baked in
The image carries the SHA-256-verified Linux build, a base font set and metric-compatible clones of common Windows fonts, so text and canvas measurements stay consistent.
Configured with env vars
Seed, platform, brand, language, timezone and TLS profile are CC_* environment variables. There's no code inside the container to maintain.
The latest build on demand
Set CLEARCOTE_LICENSE_KEY and the container resolves the newest build your licence allows, or a pinned one with CC_VERSION.
serve() and a CLI
Not using Docker? serve() in Python or Node, or clearcote-serve from a shell, does the same direct launch and gives you a CDP URL.
Any CDP client
Playwright's connectOverCDP, puppeteer.connect, browser-use, Crawl4AI, Stagehand, or the raw DevTools Protocol on the port.
An auditable Dockerfile
The Dockerfile lives in the public repository, so you can rebuild the image and compare it with the one you pulled.
How the container is set up
The container starts Clearcote directly rather than through a test driver, and exposes the Chrome DevTools Protocol on port 9222. Direct launch is the point: automation frameworks add launch switches that announce themselves, and a standing endpoint started by the image never passes them.
The default persona is a coherent native Linux identity, and that default is deliberate. Some of what a page can read comes from the operating system under the browser: in a Linux container, text is shaped by FreeType and fonts come from fontconfig, whatever the user agent says. Measured on this image with a Windows persona, a 0.01 px font-size step changed the text width on 66% of steps, against 99% on real Windows Chrome. For a Windows identity, run the Windows build, or hosted browsers, which run on Windows machines.
A licensed container downloads its engine on first start and checks out a concurrency lease, so it needs outbound access to the licence API. Mount the cache volume: measured on a fresh pull, the first start took about 22 seconds and the second, against the same named volume, about 3. A populated cache is about 1.3 GB.
What attaches over CDP
| Client | How |
|---|---|
| Playwright | chromium.connect_over_cdp(url) / connectOverCDP(url) |
| Puppeteer | puppeteer.connect({ browserURL: url }) |
| browser-use · Crawl4AI · Stagehand | Point their CDP endpoint setting at the URL |
| Anything else that speaks CDP | The raw DevTools Protocol on the published port |
What people use it for
Scrapers in Compose or Kubernetes
A browser service next to your workers, configured entirely with environment variables.
Agent frameworks
Give browser-use, Crawl4AI or Stagehand a CDP URL instead of a local Chrome.
Reproducible CI
A pinned image and CC_VERSION give every pipeline run the same browser build.
Any language
Anything with a CDP client, from Python and Node to Go or Rust, can drive the endpoint.
Clearcote is built for privacy, testing, research and lawful automation. You're responsible for how you use it and for following the terms of the sites you visit.
Which plan includes it
The Docker image, serve() and the CDP endpoint are in every tier. The image runs the open build by default; pass a licence key (free with GitHub for one browser at a time) to run the latest build. A free key's one-browser limit counts across all your containers.
FAQ
Which Docker image is it?
teamflatearth/clearcote on Docker Hub, built from the Dockerfile in the public clearcote-browser repository. Run docker pull teamflatearth/clearcote to refresh an older copy.
Is it safe to publish port 9222?
Only on a network you trust. A CDP endpoint is full control of the browser. Publish it host-locally with -p 127.0.0.1:9222:9222, or keep it on a private network, and never expose it on a public interface.
Can the container present a Windows identity?
You can set CC_PLATFORM=windows, but font metrics and system fonts in a Linux container still come from Linux, and a fingerprint test notices. The default Linux persona is coherent. For a Windows identity, run the Windows build on Windows, or use hosted browsers.
How do I run the licensed build in Docker?
Set CLEARCOTE_LICENSE_KEY and mount a volume at /opt/xdg-cache so the engine is downloaded once. It needs an image built from SDK 0.26.0 or newer, and 0.29.0 or newer for a free GitHub key. The startup log says which engine you got and whether the licence lease was acquired.
Why does navigator.webdriver stay false?
Because the browser is started directly, without --enable-automation, the switch that makes stock automation set it. Attaching a client over CDP afterwards doesn't change it.
Go deeper in the docs
Related features
Start a Clearcote browser in the cloud with one API call and connect Playwright or Puppeteer over CDP. Residential IP included, billed per GB of traffic.
Give browser-use, Stagehand, Crawl4AI or your own agent a Chromium with engine-level identity, or run Clearcote's opt-in in-browser agent with your own model.
Give Claude Desktop, Cursor or Cline a Clearcote browser through the Model Context Protocol: about twenty tools, one coherent identity underneath.
A drop-in Chromium for Playwright and Puppeteer: one import change in Python, Node or .NET, with the browser downloaded and SHA-256 verified for you.
Related reading
Try Clearcote
Open source, a drop-in for Playwright & Puppeteer, and coherent down to the TLS handshake.
Free for one browser with GitHub. No card.