Can the binary be used with selenium grid?

[juanfrilla]

I'm aware that selenium leaves a lot of detected signals but my goal is to use the binary with the selenium grid infrastructure and launch the service using the docker-compose to then use it for scraping:

version: "3"
services:
  selenium-hub:
    image: selenium/hub:4.41.0
    container_name: selenium-hub
    ports:
      - "4442:4442"
      - "4443:4443"
      - "4444:4444"
    environment:
      - JAVA_OPTS=-Djdk.httpclient.websocket.intermediateBufferSize=3000000
      - SE_EVENT_BUS_HOST=selenium-hub
    networks:
      - grid-network

  chrome:
    image: selenium/node-chrome:145.0
    shm_size: 2gb
    depends_on:
      - selenium-hub
    environment:
      - JAVA_OPTS=-Djdk.httpclient.websocket.intermediateBufferSize=3000000
      - SE_EVENT_BUS_HOST=selenium-hub
      - SE_NODE_GRID_URL=http://localhost:4444
      - SE_NODE_SESSION_TIMEOUT=120
      - SE_NODE_MAX_SESSIONS=4

    networks:
      - grid-network

networks:
  grid-network:
    driver: bridge

and maybe changing this binary argument and putting the cloakbrowser one:

display-name="Firefox Nightly" max-sessions=2 webdriver-path="/usr/local/bin/geckodriver" stereotype="{\"browserName\": \"firefox\", \"browserVersion\": \"86\", \"moz:firefoxOptions\": {\"binary\":\"/Applications/Firefox Nightly.app/Contents/MacOS/firefox-bin\"}}"

[salvador-castro]

Short answer: technically yes, but it requires a custom node image — the official selenium/node-chrome images won't work out of the box.

Selenium Grid with a custom binary works via the node stereotype mechanism you found, but there are a few constraints specific to CloakBrowser:

The core pattern (standalone Selenium, no Grid) already works — ensure_binary() + options.binary_location is documented in examples/integrations/selenium_example.py. The Grid case is an extension of that.

For Grid, you'd need to:

1. Build a custom Docker image based on selenium/node-base (not node-chrome) that installs CloakBrowser and its Linux dependencies, downloads the binary via ensure_binary() at build time, and ships the matching ChromeDriver version (must match Chromium 145/148 depending on free vs Pro).

2. Configure the node stereotype to point to the CloakBrowser binary:

json
{
  "browserName": "chrome",
  "goog:chromeOptions": {
    "binary": "/path/to/cloakbrowser-binary"
  }
}

3. Pass the stealth args from get_default_stealth_args() either via the stereotype or via your client ChromeOptions — they need to reach the binary at launch time.

One important caveat: the stealth patches are compiled into the binary, so they're always active regardless of Grid. What you won't get over Grid is humanize=True, since that's a wrapper-level feature that requires the Python/JS wrapper, not just the binary.

Has anyone on the team tried building a custom node image with this approach? Happy to share more detail on the Dockerfile structure if it'd help.

[Cloak-HQ]

Thanks for the detailed question, and thanks @salvador-castro for the solid answer — it's accurate. We actually built and ran this on a real Grid to confirm the snippet works, so here's a tested setup.

One correction first: the free binary is now Chromium 146 (not 145), and Pro is 148. That matters because ChromeDriver enforces a major-version match — your Grid node's driver major must equal the binary's major.

The cleanest path is to base your node on the official selenium/node-chrome tag whose Chromium major matches our binary. That image already ships a matching ChromeDriver and all the Chrome runtime deps — you just swap in our binary via the SE_BROWSER_BINARY_LOCATION env var (no hand-written config.toml, no node-base rebuild needed). Note your original compose used selenium/node-chrome:145.0, which bundles its own Chromium 145 and a 145 driver — that's the mismatch to avoid.

Dockerfile.cloak-node (free v146):

FROM selenium/node-chrome:146.0.7680.177-chromedriver-146.0.7680.165-grid-4.44.0-20260505
USER root
RUN apt-get update && apt-get install -y --no-install-recommends python3 python3-pip \
    && rm -rf /var/lib/apt/lists/*
RUN pip3 install --break-system-packages cloakbrowser
# Download the binary and expose it at a stable path
RUN HOME=/opt python3 -c "from cloakbrowser.download import ensure_binary; import os; \
    p=ensure_binary(); os.makedirs('/opt/cloakbrowser', exist_ok=True); \
    os.path.lexists('/opt/cloakbrowser/chrome') or os.symlink(p,'/opt/cloakbrowser/chrome')" \
    && chmod -R a+rX /opt/.cloakbrowser /opt/cloakbrowser
# Point the node's bundled chromedriver at our binary
ENV SE_BROWSER_BINARY_LOCATION=/opt/cloakbrowser/chrome
USER seluser

docker-compose.yml:

services:
  selenium-hub:
    image: selenium/hub:4.44.0
    ports: ["4444:4444"]
    networks: [grid-network]
  cloak-node:
    build: { context: ., dockerfile: Dockerfile.cloak-node }
    shm_size: 2gb
    depends_on: [selenium-hub]
    environment:
      - SE_EVENT_BUS_HOST=selenium-hub
      - SE_EVENT_BUS_PUBLISH_PORT=4442
      - SE_EVENT_BUS_SUBSCRIBE_PORT=4443
    networks: [grid-network]
networks: { grid-network: { driver: bridge } }

Client — note you do not set binary_location; the node injects it:

import random
from selenium import webdriver
from selenium.webdriver.chrome.options import Options

opts = Options()
opts.add_argument("--no-sandbox")
opts.add_argument(f"--fingerprint={random.randint(10000, 99999)}")
opts.add_argument("--fingerprint-platform=windows")
opts.add_argument("--headless=new")

driver = webdriver.Remote(command_executor="http://selenium-hub:4444", options=opts)
driver.get("https://example.com")
print(driver.execute_script(
    "return {webdriver: navigator.webdriver, platform: navigator.platform, ua: navigator.userAgent}"))
driver.quit()

When we ran this, the node (on Linux) reported platform: Win32, a Windows UA, and navigator.webdriver: false — the compiled stealth is active over the Grid path.

Honest caveats:

• The fingerprint patches are compiled into the binary, so they're always on regardless of driver. But Selenium/ChromeDriver itself introduces automation signals at the WebDriver protocol level that the binary doesn't strip — so as you already noted, a Grid/Selenium setup is inherently noisier than driving the binary through our Playwright/Puppeteer wrapper. humanize=True (human-like mouse/typing/scroll) is wrapper-level and is not available over Grid.
• For aggressive anti-bot targets, use a residential proxy and set the correct timezone + locale for the proxy exit (in the wrapper that's geoip=True; over raw Selenium pass --fingerprint-timezone / --lang / --fingerprint-locale as args). A UTC/en-US mismatch on a proxied IP is a strong bot signal.
• Pro (v148): same recipe, but base on selenium/node-chrome:148..., use ensure_binary(license_key="...") at build, and set CLOAKBROWSER_LICENSE_KEY. The latest detection patches ship in the Pro binary, so if you hit detection on a tough site, that's the upgrade path.

Let us know if this works for you, or if you want the same setup for the standalone (non-Grid) image.

[juanfrilla]

Yeeeah, thanks @salvador-castro and @Cloak-HQ for the detailed answer, really appreciate the info.
I’ve been quite busy these days and I still have a bunch of things to test related to antibots/scraping/browsers.
Give me a few days to configure the setup properly and run tests on different fingerprinting sites to see how it performs.
I’ll come back with updates.

And FYI, Selenium Grid is my go‑to setup and is easier for me than building custom Docker images with xvfb and all that. I know it leaves some detectable signals, but I can connect it to Playwright/Patchright (this time with cloakbrowser) and use it for my scraping needs.

Cheers

[juanfrilla]

Perfect I used selenium grid connected to patchright and the cloakbrowser binary, works well for me, I tested in these websites:
obviously removing those selenium signals injecting js from playwright:

    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Array;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Object;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Promise;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Symbol;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_JSON;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Proxy;
    delete window.cdc_adoQpoasnfa76pfcZLmcfl_Window;
    delete window.$cdc_asdjflasutopfhvcZLmcfl_;

https://www.browserscan.net/es -> 80%, detected incognito, audio and webgl modification
https://deviceandbrowserinfo.com/are_you_a_bot -> human
https://fpscanner.com/demo -> human (the webgl is consistent and different from Swiftshader, that's really nice)
https://cleantalk.org/recaptcha-v3-score-test -> 0.8 score
https://antcpt.com/score_detector/ -> 0.9 score

So to improve this setup, my next question is, can I spoof the user-agent instead of a linux one, a windows one and make it consistent with cloakbrowser?