Moving an LTS SafeLine install to the latest release starts with one file, not with a migration wizard. The install guide does not publish a separate upgrade command, a schema converter, or a rollback button. It does publish a hard maintenance fact: the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, LTS users are strongly recommended to upgrade to the latest version, and anyone with concerns should wait until one month after a new version is released (https://docs.waf.chaitin.com/en/GetStarted/Deploy). SafeLine itself is a self-hosted web application firewall. Deployed in front of an application, it is a reverse proxy that filters and monitors HTTP and HTTPS, and it is documented to defend against SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoors, brute force, HTTP flood, and bot abuse, with rate limiting, CAPTCHA challenge, authentication challenge, and dynamic HTML and JS protection among its listed capabilities (https://docs.waf.chaitin.com/en/home). None of those protections matter if the host is still selecting an unmaintained release track by accident.
The misconfiguration is a leftover LTS selector. Manual install writes an environment file whose sample sets IMAGE_TAG=latest and RELEASE= with an empty value. The same page defines RELEASE in one line: set it to -lts to use the LTS version (https://docs.waf.chaitin.com/en/GetStarted/Deploy). IMAGE_TAG is defined separately as the SafeLine version to be used. Those are not the same key. A common failed move looks like this on screen: the operator downloads https://waf.chaitin.com/release/latest/compose.yaml into the SafeLine directory, sees latest in that URL, sees IMAGE_TAG=latest, and stops reading. The next line, or a line left over from the original LTS install, still says RELEASE=-lts. That is the documented LTS switch. Until that value is empty, the environment file has not been brought in line with the latest sample, no matter how many times the latest compose file is fetched. The automated installer, bash -c with the latest manager.sh and an --en argument, is documented as the way to start an automated installation. It is not documented as an in-place rewrite of an existing LTS environment file, so a successful-looking curl is not evidence that RELEASE was cleared.
Confirm the fix on two screens the guide already names. First, open the environment file in the SafeLine directory. The corrected screen shows RELEASE= and nothing after the equals sign, IMAGE_TAG=latest, SAFELINE_DIR pointing at the directory you intend to keep, MGT_PORT set to the console port you will actually open, and MGT_PROXY left at 0 unless you are configuring console proxy layers. The sample default port is 9443. ARCH_SUFFIX is empty on x86_64 and -arm on ARM, with POSTGRES_IMAGE switched to the documented ARM image name only in the ARM case. The file should still contain the postgres password, subnet prefix, image prefix, and the generated detector and management secrets, and it should remain readable only by the owner because the guide sets chmod 600 on .env. If RELEASE=-lts is still visible, you have not fixed the selector. Do not invent a second flag to override it. The documented latest sample uses an empty RELEASE, not a new token such as a made-up stable or current label.
Second, start from that directory with the documented launch command, docker compose up -d. The install guide says this can take several minutes. The confirming screen is not an imagined upgrade banner. It is the web console at https://<safeline-ip>:9443/. If you cannot log in and you need the administrator account, docker exec safeline-mgt resetadmin prints the initial username and the initial password. Read that output in the terminal and store it outside the chat log. A console login page after an environment file that shows an empty RELEASE is the pair that confirms the selector change and a started UI. It does not, by itself, prove that old LTS data was converted. The install guide never documents data migration, database conversion, or rollback, so do not describe the login page as a completed data upgrade. Describe it as the documented sign that the stack you just started presented its console.
Run the dependency checks before you change the release line, because a bad host will hide a good .env. The guide requires Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, at least 1 CPU core, 1 GB of memory, 5 GB of disk, and the ssse3 instruction (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The listed commands are uname -m, docker version, docker compose version, a processor listing from /proc/cpuinfo, free -h, df -h, and lscpu filtered for ssse3. On ARM, an empty ARCH_SUFFIX is its own misconfiguration, separate from RELEASE. SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. Clearing the LTS flag does not remove that license boundary. If ssse3 is missing, or disk is under 5 GB, fix the host first. Fetching compose.yaml again will not add a CPU instruction.
Do not confuse uninstall with the move. Documented uninstall is to enter the SafeLine directory, run docker compose down, then remove that directory with rm -rf (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The removal deletes SafeLine data. An empty directory is the screen for a completed uninstall, not the screen for a move to latest. If the only wrong line is RELEASE=-lts, leave the directory in place, correct that line to the empty latest value, and use the start command. There is no documented backup command in the install guide, so treat deletion as final.
Once the console is up, prove the proxy path with the application guide rather than with another release flag. Log in, open Applications, and add an application with the original domain or host, the listen port, and the upstream address. For HTTPS, check the SSL option. Then resolve that domain to the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The guide's attack checks are query-string cases for SQL injection, XSS, path traversal, code injection, and XXE. Replace the example domain with yours. The confirming screen for filtering is the blocking page. The confirming screen for visibility is the attack list in the web console, then the detail view. A login page only means the management UI answered. The blocking page plus detail means this instance filtered a request after you left the LTS selector behind.
If the console does not load, return to the environment file before you download anything else. Check that MGT_PORT matches the port in the browser URL, that MGT_PROXY is still 0 when no console proxy is configured, and that RELEASE is empty rather than -lts. Recheck Docker and Compose versions against the minimums above. The guide's advice on timing still applies: if you are uneasy about a build that has just appeared, wait one month after that release before you move. The maintenance note is a recommendation to leave LTS, not an order to cut over on the announcement day.
Why does IMAGE_TAG=latest not prove the install left LTS?
IMAGE_TAG is the version field in the sample file, and the sample sets it to latest. RELEASE is a different key. The install guide says to set RELEASE to -lts when you want the LTS version, and the latest sample leaves RELEASE empty (https://docs.waf.chaitin.com/en/GetStarted/Deploy). A file that still shows RELEASE=-lts has not left the documented LTS selector, even if the compose file came from the latest URL.
What screen confirms the release setting was corrected?
Read the environment file. The corrected screen is RELEASE= with an empty value beside IMAGE_TAG=latest. Then run docker compose up -d from the SafeLine directory and open https://<safeline-ip>:9443/. That web console is the start screen the install guide documents. If you need credentials, docker exec safeline-mgt resetadmin prints the initial username and password. There is no documented upgrade-complete log line beyond those screens.
Should I uninstall before moving to the latest release?
No. Uninstall stops the stack with docker compose down and then deletes the SafeLine directory, which removes data (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Use that only when you mean to stop using the product. The latest sample does not ask you to delete data in order to clear RELEASE. An empty directory confirms uninstall, not a release move.
How do I confirm the console is actually protecting traffic?
Add the application with domain, port, and upstream, and point DNS at the SafeLine host (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Try one documented test case, such as a SQL injection or path traversal query string, on your own domain. The blocking page confirms the request was stopped. The attack list and its detail view confirm the console recorded it. A reachable login page does not prove that filtering path.
What should I check on ARM before clearing RELEASE?
Run uname -m first. On ARM the guide sets ARCH_SUFFIX to -arm and names the ARM Postgres image. SafeLine on ARM requires a Pro license, and the Personal Edition is not supported on ARM (https://docs.waf.chaitin.com/en/GetStarted/Deploy). An empty RELEASE value does not change that. Also confirm Docker 20.10.14 or newer, Compose 2.0.0 or newer, memory, disk, and ssse3 before starting the stack again.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.