A self-hosted web application firewall only helps after it is actually running in front of the origin. SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet, and the install guide treats one published command as the recommended automatic path. This article follows that path only: check the Linux host against the documented dependencies, run the official manager script as root, open the web console, and then place an application behind the reverse proxy. It does not invent extra flags, custom ports, or a separate uninstall switch for that script.
The product introduction describes SafeLine as a reverse-proxy shield. Clients pass through the WAF before they reach the server. It filters, monitors, and blocks malicious HTTP and HTTPS traffic, and it is described as preventing unauthorized data from leaving the application by applying policy. The same page lists typical coverage for SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Named core capabilities are web-attack defense, proactive bot-abuse defense, HTML and JavaScript code encryption, IP-based rate limiting, and a web access control list. The feature list also describes rate limiting against denial of service, brute force, traffic surges, and other abuse; CAPTCHA challenge; authentication challenge; and dynamic protection that encrypts HTML and JavaScript on each visit. Those controls are configured after installation. They are not arguments to the manager script. See the SafeLine introduction for that capability list.
The install guide states the host requirements before either install method. The operating system must be Linux. The instruction architecture must be x86_64 or arm64. Docker must be version 20.10.14 or above, and Docker Compose must be version 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support the ssse3 instruction. The same page publishes these confirmation commands:
uname -m
docker version
docker compose version
cat /proc/cpuinfo | grep "processor"
free -h
df -h
lscpu | grep ssse3
A missing dependency is a reason to stop. The automatic section does not document switches for architecture, a custom data directory, a custom console port, or an LTS release. Those choices appear in the manual compose section, where you create a SafeLine directory, download compose.yaml, and write .env. If the server is ARM, that manual section states that SafeLine installed on ARM requires a Pro license to work properly and that the Personal Edition is not supported on ARM. Nothing in the automatic command says the manager script waives that constraint, so an ARM host should be treated as a licensing decision before you install.
When the checks match the guide, the recommended automatic command is the official manager script. It requires root privileges:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
The deploy page says that after this command is executed, installation has succeeded, and you should go directly to the web UI. Open https://<safeline-ip>:9443/ in a browser. The initial administrator account is obtained with a separate documented command:
docker exec safeline-mgt resetadmin
On success, the guide shows an initial username of admin, an initial password, and a reminder to keep that output. Log in with that password. Do not assume the script printed a durable account record anywhere else.
A running console is not the same as a protected site. The application guide says SafeLine is a web application firewall developed based on nginx and that it works as an HTTP and HTTPS reverse proxy. It receives traffic for the original website, cleans malicious traffic, and forwards the remaining traffic to the original application. In the web admin console, open Applications and choose Add Application. Enter the domain, hostname, or IP address of the original app; the port SafeLine will listen on, such as 80 or 443; and the upstream address used to forward traffic. For an HTTPS app, check the SSL option. Then resolve the domain you entered to the IP address of the server where SafeLine is located. Until that resolution exists, the path described in the guide is not in place.
Verification belongs on an application you control. The application guide names SQL injection, XSS, path traversal, code injection, and XXE as sample attack classes, and it says a blocking page means the attack was defended. The web console attack list, including the detail view, is where that guide says to inspect what was recorded. One blocked request does not configure rate limiting, CAPTCHA challenge, authentication challenge, or dynamic protection. Those remain separate features described in the introduction.
Keep the manual route in reserve rather than mixing it into the script. The install guide documents a directory such as /data/safeline, a requirement of at least 5 GB of disk for that directory, a downloaded compose file, environment variables, secret generation, permission steps, and docker compose up -d. It also documents uninstall as entering the SafeLine directory, running docker compose down, and then removing that directory, only when you are sure you no longer want to use SafeLine. Those are manual steps. They are not published as manager-script options. If you set RELEASE to the LTS value in the manual file, the same page says the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, and it strongly recommends that LTS users upgrade to the latest version.
The supported order is therefore short. Match Linux, architecture, Docker, Docker Compose, ssse3, memory, and disk to the install guide. Run the official manager script with root. Open the console on port 9443 and reset the admin account with the documented container command. Add the application, point the domain at the SafeLine server, and confirm blocks in the console. That is how to install this WAF with the official Linux manager script without adding steps the deploy page does not publish.
What does the official manager script require?
The install guide marks automatic deployment as recommended and says the command requires root privileges. It also requires Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, a CPU with ssse3, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk. Run the published check commands before the installer.
Does a finished script mean the site is already protected?
No. The deploy page says a completed command means installation succeeded and that you should use the web UI. The application guide says protection is the reverse-proxy setup: add the application, set domain, listen port, and upstream, check SSL for HTTPS, and resolve the domain to the SafeLine server IP.
Where is the first console password documented?
Open https://<safeline-ip>:9443/ and run docker exec safeline-mgt resetadmin. The install guide says a successful run shows the initial username admin and an initial password, and it tells you to remember that content before you log in.
When is the manual compose path the documented alternative?
Use the manager script for the recommended automatic install. Use the manual section when you need the published compose workflow, including the SafeLine directory, compose.yaml, .env values, generated secrets, and docker compose up -d. On ARM, that section states that a Pro license is required and that the Personal Edition is not supported.
Which settings are outside the automatic command?
The automatic section does not publish a custom console port, an LTS switch, token generation, console proxy layers, or an uninstall flag. ARCH_SUFFIX, RELEASE, MGT_PORT, and related variables are documented in the manual .env instructions. Uninstall is docker compose down in the SafeLine directory, followed by removal of that directory.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.
