How to Install SafeLine WAF with Docker in 10 Minutes
SafeLine is designed to run as a container, which makes Docker the natural
deployment path. This walkthrough gets you from zero to a working reverse-proxy WAF.
What you need
- A Linux host (VM or bare metal) with Docker installed.
- At least 1 CPU, 1 GB RAM, 5 GB free disk.
- A service you want to protect (e.g., a web app on port 8080).
Step 1: Install SafeLine
Run the official installer:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
This pulls the SafeLine containers and starts the management console.
Step 2: Open the dashboard
Navigate to https://<your-host-ip>:9443. Complete the initial setup and create an admin
account. You can also explore the live demo first at
https://demo.waf.chaitin.com:9443/statistics.
Step 3: Add your upstream
In the console, register the site you want to protect and point its upstream at your real app
(e.g., http://127.0.0.1:8080). SafeLine now inspects traffic before proxying it.
Step 4: Route traffic
Point your domain or load balancer at the SafeLine listener instead of the app directly. SafeLine
blocks malicious requests (SQLi, XSS, bot abuse) using its semantic-analysis engine.
FAQ
Do I need docker-compose?
The installer manages containers for you; compose is optional for custom setups.
What if the container restarts?
SafeLine persists config; set a restart policy so it comes back automatically.
Is this production-ready?
Yes — the Community Edition is free and handles 10 apps at 800 QPS.
Wrap Up
If you want a self-hosted WAF you fully control, SafeLine is worth a look. It sits in
front of your existing stack as a container, uses a semantic-analysis engine to catch SQL
injection, XSS, and bot abuse with very low false positives, and the Community Edition is
free.
Deploy it in minutes:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en