Losing the SafeLine console password usually starts with a reasonable but wrong edit. After installation, the web UI is opened at https://<safeline-ip>:9443/, and the deploy guide does not store that login in the Compose environment file. Resetting the administrator account is a container command. The failure mode below is one concrete mix-up: treating POSTGRES_PASSWORD as the console password, then trusting a restart that never printed a new admin credential.
A manual install keeps SafeLine configuration and data in a directory you create. The deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy uses /data/safeline as the example. Inside it, .env holds SAFELINE_DIR, IMAGE_TAG, MGT_PORT, POSTGRES_PASSWORD, SUBNET_PREFIX, and several generated secrets. That same guide defines POSTGRES_PASSWORD as the Postgres database initialization password. It is consumed when the database is initialized. It is not the account you type into the management UI.
The misconfiguration looks like this. The operator cannot log in, opens .env, replaces POSTGRES_PASSWORD, optionally rewrites DETECTOR_MGMT_TOKEN or MGT_INTERNAL_TOKEN, and runs docker compose up -d again. Compose can bring the stack process up. That result does not print an administrator username or a console password. The web account was never that database variable, so the edited string is the wrong secret for the login form.
File mode is a related dead end. The guide sets .env to mode 600 and restricts resource directories such as resources/mgt and resources/postgres/data. Those permissions protect local secrets and sockets. Changing them does not rotate the console user.
Reset the account inside the management container
Use the procedure in the deploy guide, in order.
Confirm the host meets the documented dependencies before you blame the password command: Linux, x86_64 or arm64, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The guide also lists a minimum of 1 core CPU, 1 GB memory, and 5 GB disk, plus the ssse3 CPU flag. Those checks explain a stack that never became ready. They are not a second password store.
From the SafeLine directory that contains compose.yaml and .env, start the services with docker compose up -d. The guide warns that this can take several minutes. When it finishes, request the administrator account from inside the management container:
docker exec safeline-mgt resetadmin
The container name in that command is safeline-mgt. Do not point docker exec at the Postgres image named in .env, and do not expect the automatic installer shell to reprint the password later. The documented recovery for the administrator account is this exec, described under Get Administrator Account in https://docs.waf.chaitin.com/en/GetStarted/Deploy.
The screen that confirms the fix
Success is a terminal screen, not a Compose health line. The deploy guide says that after the command succeeds you must remember the printed content. The confirming text begins with the sentence Please must remember this content. It then prints three [SafeLine] lines: initial username admin, initial password, and Done. The password in the guide is shown masked. On your host, copy the characters that appear in that password field. Asterisks in the documentation are not the credential.
If that remembered-content screen is absent, the reset is not confirmed. Do not fall back to POSTGRES_PASSWORD, and do not paste a token from .env into the login form. DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN are internal values written during setup. The guide does not present them as console passwords.
After the screen is present, open the console with HTTPS on the SafeLine host and the console port. The documented URL is https://<safeline-ip>:9443/. MGT_PORT is defined as the web console port, and the sample .env sets it to 9443. If you changed MGT_PORT before startup, use that port instead. MGT_PROXY is the number of console proxy layers. The sample keeps it at 0 when no console proxy is configured. It does not replace resetadmin.
The guide then says to enter the password from the previous step, after which you are logged into SafeLine. A successful login with that exact password is the second confirmation. Seeing a block page on a test request only proves that a protected application filtered an attack, as described in https://docs.waf.chaitin.com/en/GetStarted/AddApplication. It does not prove that the admin reset ran.
What not to reset by accident
SafeLine is a self-hosted web application firewall, per https://docs.waf.chaitin.com/en/home. Deployed in front of an application, it is a reverse proxy: clients reach SafeLine first, malicious HTTP and HTTPS traffic is filtered, and safe traffic is forwarded to the upstream. The same overview lists defenses against attacks such as SQL injection, XSS, command injection, path traversal, SSRF, and brute force, plus rate limiting, CAPTCHA challenge, authentication challenge, and dynamic HTML and JS protection. None of that is configured by the admin reset command.
Application proxy settings are entered after login. The protecting-applications guide tells you to open Applications, add an application, and set domain, listen port, and upstream. Resetting the console user does not document a change to those fields.
Do not uninstall to recover a password. Uninstall, in the same deploy guide, is docker compose down in the SafeLine directory and then removal of that directory. That deletes local configuration and data. It is a different operation from docker exec safeline-mgt resetadmin.
Close the loop with the original mistake
Before you leave the host, check four facts against the screen you just saw. The stack was started with docker compose up -d. The reset targeted safeline-mgt. The terminal showed the remember-this-content notice, username admin, a password, and Done. The browser used HTTPS and MGT_PORT, normally 9443, with the password copied from that screen rather than from POSTGRES_PASSWORD.
Why does editing POSTGRES_PASSWORD fail to reset the console admin?
The deploy guide defines POSTGRES_PASSWORD as the Postgres initialization password in .env. The documented way to obtain the console administrator account is docker exec safeline-mgt resetadmin. A Compose restart can leave the web password unchanged because that variable was never the console credential.
How do I know the container reset actually finished?
The confirming screen is the output documented for resetadmin: the notice to remember the content, then [SafeLine] lines for initial username admin, initial password, and Done. No other log in the install guide is described as that credential. If those lines are missing, there is no new admin password to type.
Which URL matches the password I just reset?
Log in at https://<safeline-ip>:9443/ unless MGT_PORT in .env was set to another console port. Use HTTPS. The upstream site you are protecting is not the management UI, and a guess on the application listen port will not submit this credential to the console.
Can I reset the admin account before docker compose up finishes?
The guide places Get Administrator Account after Launch SafeLine. Run docker compose up -d first and allow the start, which may take several minutes. resetadmin is an exec into safeline-mgt, so the management container has to be there for the command to return the success screen.
Will this admin reset delete applications or replace the database password?
The documented command prints an initial username and password for the console. It does not say that applications, upstreams, or POSTGRES_PASSWORD are rewritten. Removing the install directory is the uninstall path, and that path does delete SafeLine data, so keep uninstall and admin reset separate.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.