husarion/rosbridge repository overview

⁠husarion/rosbridge

In-house Rust ROS 2 ↔ WebSocket bridge implementing the rosbridge v2 protocol⁠ — a drop-in replacement for foxglove-bridge for robot web UIs, with a low-latency media plane for camera video and audio.

It speaks the standard rosbridge JSON/CBOR protocol (so roslibjs⁠ clients work unchanged) and adds a binary media channel for H.264 + Opus.

⁠Tags

• husarion/rosbridge:X.Y.Z — a specific release (multi-arch: linux/amd64, linux/arm64).
• husarion/rosbridge:latest — the newest release.

⁠What it does

• Data plane — subscribe / unsubscribe / advertise / publish / call_service, QoS mirroring (matches best-effort sensor + transient-local latched publishers), CBOR compression, per-subscription throttle_rate, and set_level status filtering.
• Media plane — H.264 video and Opus audio streamed as compact binary frames on negotiated channels, decoded in-browser via WebCodecs (lower latency than re-encoding JSON arrays).
• Actions — send_action_goal / cancel_action_goal with action_feedback / action_result streamed back.
• Assets — fetches package:// resources (meshes, configs) from distributed providers over the same socket.
• rosapi — the introspection subset roslibjs apps expect (/topics, /services, /topic_type, /topics_for_type, /get_time).
• Health — /healthz, /readyz, /metrics on an opt-in side port.
• Filtering — optional anchored-regex allowlists per direction (subscribe / publish / services / actions) and capability-class switches, enforced on every op and mirrored in rosapi listings; denials answer loudly. Unset = allow-all.

⁠Security model

The bridge is full robot control for anyone who can reach its port — no authentication, no TLS by design, cleartext ws://. Run it only behind an enforced boundary: bind to a Husarnet-only / private interface, or put it behind a reverse proxy + firewall that terminates TLS and authenticates. Set ROSBRIDGE_ALLOWED_ORIGINS to your cockpit origin(s) to block cross-site WebSocket hijacking through an operator's browser (blast-radius reduction, not authentication). Never expose [::]:8866 on a public NIC.

⁠Quick start

docker run --rm --network host --ipc host \
  -e ROSBRIDGE_BIND=0.0.0.0:8866 \
  -e RMW_IMPLEMENTATION=rmw_cyclonedds_cpp \
  husarion/rosbridge:latest

The bridge listens for WebSocket clients on :8866 (override with ROSBRIDGE_BIND; use [::]:8866 to also accept IPv6 / Husarnet — only on a private interface, see the security model above). It binds against the robot's ROS 2 graph using the configured RMW.

⁠Environment

⁠Source

Built from github.com/husarion/husarion_rosbridge⁠. Pairs with the optional @husarion/roslib-media⁠ browser companion (WebCodecs H.264 + binary/WebTransport, falling back to stock roslibjs).