The "Puppeteer Maintenance Tax"
Every developer starts the same way: npm install puppeteer and a simple Node
script. On localhost, it works perfectly. In production, things break.
Memory Bloat: Chromium instances can consume 300MB+ per page, leading to OOM (Out of Memory) kills.
Zombie Processes: Headless browsers frequently fail to close cleanly, leaving orphan processes that eat CPU cycles.
Security Holes: Without egress filtering, an attacker can use your PDF generator to scan your internal VPC (SSRF).
[CRIT] Process 4049 (chrome) exited with status 137 (OOM)
[WARN] 14 Zombie chrome processes detected. Reaping...
[ERR] SSRF Attempt blocked? No egress filter found.
[INFO] Available Memory: 14MB / 1024MB
How RocketUtils Solves It
Managed V8 Lifecycle
We don't just "run chrome." We manage the V8 garbage collector and process cycles. Our **Reaping Cycles** ensure every browser instance is wiped and the process is killed the millisecond your PDF is ready.
SSRF Hardening
Security is non-negotiable. Our rendering engine is wrapped in an egress proxy that blocks all
127.0.0.1, 169.254.169.254, and private range IPs. Your internal
network remains invisible.
Global Timeout Tiering
Infinite loops in JS or heavy assets shouldn't stall your queue. We implement a multi-tier timeout system (Navigation, Rendering, and Serialization) to maintain predictable latency.
Built for Your Use Case
Automated Invoice Generation
Generating 10,000 invoices on a shared cluster often leads to slow response times. RocketUtils uses a **Priority Queueing** system for Pro/Mega tiers, ensuring your billing cycles run like clockwork without scaling your own infra.
- Custom WebFonts / Google Fonts support
- Pixel-perfect table rendering with modern CSS
- SVG and optimized image embedding
const pdf = await fetch('https://rocketutils.dev/v1/pdf', {
method: 'POST',
headers: { 'x-api-key': 'DEMO' },
body: JSON.stringify({ html: '<h1>Invoice #123</h1>' })
});
User-Generated Resumes
When users provide the HTML, you face the greatest security risk. Our **V8 Sandboxed Context** ensures that one user's malicious script or heavy CSS can't access another user's data or crash the service.
- Dedicated context per request
- No data persistence (Stateless)
- Compliance-ready security architecture
[ Resume Template Previewing... ]
Technical Specifications
Under the hood of the RocketUtils engine
Rendering Precision
We use **Chromium 120+** (stable) as our baseline. This means support for the latest CSS
specifications including aspect-ratio, container queries, and advanced
Flexbox/Grid features. Our DPI is locked for 300dpi printing by default.
"We tested RocketUtils with several heavy Tailwind CSS dashboards. It's the only API that didn't stagger on the complex layout calculations."
Security & Sandboxing
Security is handled at three layers:
- Network Layer: Firewall rules prevent any outgoing traffic to private IP ranges (RFC 1918).
- Process Layer: Each Chromium process run as a non-privileged user with limited syscall access.
- Data Layer: We use an ephemeral filesystem. Every temporary file is deleted the moment the buffer is returned.
Scale-Tested Performance
| Payload Size | Avg. Response Time | Success Rate | Memory Spike |
|---|---|---|---|
| 10KB (Simple Invoice) | 1.8s | 99.99% | ~140MB |
| 500KB (Doc with Images) | 2.6s | 99.95% | ~280MB |
| 5.0MB (Heavy Report) | 5.8s | 99.8% | ~650MB |
Data collected from 50,000+ production requests processed in Feb 2026.
Frequently Asked Questions
How fast is the HTML to PDF conversion?
Typical response times are ~1.8s for simple invoices and ~2-4s for complex reports. We use a tiered timeout system to ensure predictable latency.
How do you prevent SSRF attacks?
We implement a strict egress proxy that blocks all requests to private IP ranges
(127.0.0.1, 192.168.x.x, 10.x.x.x) and cloud metadata
services (169.254.x.x).
Can I use this instead of managing my own Puppeteer cluster?
Yes. RocketUtils is designed to replace self-hosted Puppeteer/Playwright clusters. We handle the memory leaks, zombie processes, and scaling challenges for you.
What is the maximum HTML size I can send?
The API accepts HTML payloads up to 10MB. For larger documents, we recommend splitting them or referencing external assets.
Is this suitable for generating invoices?
Absolutely. It's our most common use case. We support custom fonts, CSS Grid/Flexbox, and page
breaks (@page { break-after: always }) for multi-page invoices.
Is the service GDPR compliant?
Yes. We are a "Data Processor" only. We do not persist any PII (Personally Identifiable Information) sent in your HTML. Your data exists only in ephemeral V8 memory and is discarded immediately after rendering.
Ready to skip the infra headaches?
Join 100+ developers generating reliable documents with RocketUtils.
No credit card required to start.