socat: The Receptionist Inside the Pod

Chrome 128 only listens on localhost. socat sits inside the same pod and relays external calls to Chrome's local port, bypassing the restriction.

The Problem

Chrome only reads the group chat (127.0.0.1). The API pod is on a different phone. It can only dial the extension. Chrome will not pick up.

The Fix

socat is a receptionist inside the Chrome pod. It sits at the front desk (0.0.0.0:9222) and accepts calls from anyone. When a call arrives, socat walks it to Chrome’s group chat (127.0.0.1:9223) and carries the answer back.

Chrome thinks socat is a local app. Because socat IS local. It runs in the same pod.

Command:

socat TCP-LISTEN:9222,fork,reuseaddr,bind=0.0.0.0 TCP:127.0.0.1:9223 &

fork: accept many calls at once
reuseaddr: reuse the port after a restart
bind=0.0.0.0: accept calls from anyone
&: run in the background

If the Docker image hardcodes relay ports (for example, CHROME_FORWARD_PORT=9222), the deployer must override them for different ports. Without the override, socat relays to the wrong port. The pod starts. No error appears. But no connection works. See how the entrypoint starts socat.

“Chrome thinks the receptionist is a coworker passing notes. It does not know the call came from a different phone.”

References:

Related: see the Chrome 128 localhost lock that created this problem, or go back to the series overview.

Tags #kubernetes #chrome-devtools #containers