Deployment choices
The alpha supports a full reverse-proxy setup and selective crawler routing behind an existing edge. In both cases, the renderer needs a fixed route to the original application. It must not render its own frontend. This project website is static Hugo output and does not host a render backend.
Standalone reverse proxy
Put TLS termination in front of RenderCache’s public listener, configure the original app and public site root, and let Go classify document requests. Matching crawler claims can use the saved copy; humans and private/API requests continue to the origin. This gives the delivery log visibility into crawler bypasses as well as snapshot responses. Keep the separate admin listener on a private interface or secure tunnel.
The default snapshot budget is 1 GiB of serialized records and 10,000 files. Rejected writes retain old copies. There is no automatic eviction: stop the service and use prune --older-than 720h when you deliberately want to remove old records. Writable commands share a process lock; use the live purge API for refreshes while serving.
Container with Chromium
The source includes a Dockerfile and compose example. The image runs as UID 10001, includes Chromium and tini, and leaves Chrome’s sandbox enabled. Compose binds the public port to host loopback, does not publish admin, uses a persistent data volume and capped temporary space, and restricts CPU, memory and processes with a read-only root filesystem and dropped capabilities.
Set an origin address reachable from inside the container. Host loopback inside the container is the container itself. Verify user namespaces, seccomp and host security policy for the sandbox. A sandbox failure is a render failure; the engine never automatically turns it off. The isolated CI smoke uses an explicit opt-out, so treat it as packaging evidence rather than proof of your host’s sandbox setup. Do not routinely add privileged or SYS_ADMIN access to make Chrome start.
nginx in front
The tested nginx example routes crawler claims through RenderCache and humans directly to the app. Go remains responsible for snapshot eligibility and privacy bypasses. The sample keeps the cache and admin private, preserves escaped paths and query strings, and disables nginx proxy caching. Add your existing TLS configuration and keep the crawler list aligned with the Go configuration.
Cloudflare Worker routing
The Worker example routes selected credential-free GET/HEAD crawler requests to a separate HTTPS RenderCache backend. It overwrites an edge-key header, uses manual redirects, and disables subrequest caching. The Go backend requires the same edge secret and strips it before forwarding to the application. Other traffic retains normal origin behavior and is outside RenderCache’s log visibility in this topology.
The Worker logic is request-tested but has not been deployed to a live zone. Configure its Route, backend, secrets, and any overriding zone Cache Rules yourself. Do not route the backend hostname through the same Worker. No domain or Worker is deployed by the repository.
Read the operational limits
The engine bounds browser jobs, HTTP work, connections, HTML sizes and diagnostic work. OS/container controls still need to constrain Chromium memory, temporary files and processes. The data directory is single-owner and local; network/shared-volume operation is unsupported. Snapshots use Linux file and directory fsync, while delivery logs are best-effort operational records.
Use the complete tagged deployment guide for commands, limits and release verification.