Developer tools · Maintained fork

ForgeGuard Markdown Live Preview

A privacy-conscious, browser-only Markdown editor with live preview, packaged by ForgeGuard as a self-hostable container and Helm chart.

Status: Active
License: MIT
Upstream: tanabe/markdown-live-preview
Language: JavaScript

Overview

What it solves.

Markdown Live Preview is a small, entirely client-side web tool: you type Markdown on the left and see the rendered HTML on the right. There is no backend, no account, and no document upload — the editor, parser, and preview all run in your browser tab.

This repository is a ForgeGuard maintained fork. Upstream tanabe/markdown-live-preview owns the original application and its identity. ForgeGuard packages it for self-hosting and hardens its default privacy and security behavior: the Monaco editor is bundled from local dependencies instead of a runtime CDN, analytics is opt-in, remote images are blocked by default, rendered links pass through a strict URL policy, browser persistence is bounded, and the static container ships a restrictive Content Security Policy and security headers.

Verified capabilities

What it does.

Browser-only renderingEditing, parsing (marked), and sanitizing (DOMPurify) all run in the tab; no server processes your content.
Local Monaco bundlingThe Monaco editor is bundled from project dependencies, not a runtime CDN.
Opt-in analyticsGoogle Analytics is disabled by default and loads only after you enable the Analytics toggle.
Private modeSuppresses saving editor content to browser storage for the session.
Remote-image controlCross-origin images are blocked by default; an explicit toggle enables them with no-referrer and lazy loading.
URL scheme policyRendered links are limited to safe schemes and receive rel="noopener noreferrer nofollow".
Bounded persistenceEditor content is retained for 30 days and settings for 365 days in localStorage, not indefinitely.
Hardened containerThe Nginx image sets a strict CSP plus clickjacking, MIME, referrer, and permissions headers, with a non-root, read-only posture.

Operational facts

The operating contract.

Runtime	Static single-page app served by Nginx; no backend and no server-side content processing
Rendering	marked (Markdown to HTML) with DOMPurify sanitizing, entirely in the browser
Editor	Monaco, bundled from project dependencies rather than a runtime CDN
Distribution	GHCR container image plus an OCI Helm chart (versioned independently); container images built for linux/amd64 only
Persistence	localStorage — content retained 30 days, settings 365 days; Private mode suppresses saving
Third-party paths	Opt-in analytics (off by default), remote images (off by default), and an SRI-pinned PDF-export library from a CDN
Upstream tracking	Tracks upstream tagged releases; does not include upstream's Mermaid rendering

Evidence

Run it yourself.

Run it with Docker

docker run --rm -p 8080:80 ghcr.io/forgeguard-ai/markdown-live-preview:latest
curl --fail http://localhost:8080/

Then open http://localhost:8080 and start typing Markdown — the editor, parser, and preview all run in your browser tab.

Architecture

Data flow.

Everything runs inside the browser tab. Nginx serves the static app and assets; the Monaco editor, marked parser, DOMPurify sanitizer, and preview all execute client-side. The only routes to third parties — opt-in analytics, remote images, and the PDF-export library — are off by default or explicitly gated.

Nginx static hostServes app + assets · strict CSP

Browser tabMonaco · marked · DOMPurify

localStorageContent 30d · settings 365d

Deployment

Deployment paths.

Container

docker run --rm -p 8080:80 ghcr.io/forgeguard-ai/markdown-live-preview:latest

Local use and single-service hosting from the published GHCR image.

Docker Compose / Portainer

docker compose up -d

Durable single-host operation; Portainer for managed remote Docker environments.

Kubernetes (Helm)

helm install markdown-live-preview \
  oci://ghcr.io/forgeguard-ai/helm-charts/markdown-live-preview --version 0.1.1

Cluster deployment via the OCI Helm chart, versioned independently of the image.

Compatibility

Support matrix.

Target	Status	Notes
linux/amd64 containers	Supported	Container images are currently built for linux/amd64 only
linux/arm64 containers	Not published	amd64-only at present
Kubernetes (Helm)	Supported	OCI Helm chart at ghcr.io/forgeguard-ai/helm-charts, versioned independently
Modern browsers	Supported	The app is client-side and runs in the browser tab

Responsibility

Privacy and security defaults.

Browser-only: editing, parsing, and sanitizing run in the tab, so no server processes your content.
Privacy-hardened defaults: analytics is opt-in, remote images are blocked by default, localStorage is bounded, and rendered links pass a strict URL/scheme policy.
Sanitized rendering (DOMPurify) reduces risk but is not a complete isolation boundary for hostile Markdown or browser vulnerabilities.
The static container ships a restrictive CSP plus clickjacking, MIME, referrer, and permissions headers.

Lineage & attribution

Where this work comes from.

A ForgeGuard AI maintained fork of tanabe/markdown-live-preview by Hideaki Tanabe. The application is upstream-authored; ForgeGuard adds privacy hardening and self-host packaging. Distributed under the MIT License, © 2020 Hideaki Tanabe, with the original copyright preserved. Not affiliated with or endorsed by the upstream project.

tanabe/markdown-live-previewMIT
The upstream browser-only Markdown editor, by Hideaki Tanabe.
markedMIT
The Markdown-to-HTML parser.
DOMPurifyApache-2.0 OR MPL-2.0
Sanitizes rendered HTML output.
Monaco EditorMIT
The code editor, bundled locally rather than from a CDN.

Status & limitations

Known limitations.

Container images are currently built for linux/amd64 only.
The fork does not include upstream's Mermaid rendering.
PDF export fetches one script (SRI-pinned) from a third-party CDN at runtime.
Sanitized rendering is not a complete isolation boundary for hostile Markdown or browser vulnerabilities.

Release history is published on the repository releases page.

Documentation

Read the docs.

Versioned documentation for Markdown Live Preview is published from the repository'sdocs/site/ tree.

Documentation README on GitHub Report an issue