Back to SafeLine
SafeLine install docs

Install SafeLine WAF with Docker on Linux.

This local guide mirrors the official deployment flow, but keeps the commands and explanations on this site so users can finish the install without jumping away first.

Start automatic installManual Docker path

Step 0

Dependencies

SafeLine is a Linux-first deployment. Before installing, confirm the host has enough resources and supports the required Docker stack.

Operating systemLinux
Instruction architecturex86_64, arm64
Docker20.10.14 or above
Docker Compose2.0.0 or above
Minimum environment1 core CPU / 1 GB memory / 5 GB disk
CPU instructionssse3
bash
uname -m                                   # View instruction architecture
docker version                             # View Docker version
docker compose version                     # View Docker Compose version
cat /proc/cpuinfo | grep "processor"       # View CPU info
free -h                                    # View memory info
df -h                                      # View disk info
lscpu | grep ssse3                         # Check CPU ssse3 instruction

Recommended

Automatic Deploy

This is the simplest path. It starts the automated SafeLine installer and requires root privileges. When the command finishes successfully, jump to the Web UI section.

bash
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Alternative path

Manual Docker Compose Deploy

Use manual deployment when you want to inspect the compose file, control the install directory, or understand exactly what gets written to disk.

1. Install Docker

bash
curl -sSL "https://get.docker.com/" | bash

2. Create the SafeLine directory

SafeLine writes configuration and data into this directory. Keep at least 5 GB of disk space available.

bash
mkdir -p "/data/safeline"

3. Download the Docker Compose script

bash
cd "/data/safeline"
wget "https://waf.chaitin.com/release/latest/compose.yaml"

4. Write environment variables

bash
cd "/data/safeline"
touch ".env"

Open .env and write the following values. Replace {postgres-password} with a strong password.

bash
SAFELINE_DIR=/data/safeline
IMAGE_TAG=latest
MGT_PORT=9443
POSTGRES_PASSWORD={postgres-password}
SUBNET_PREFIX=172.22.222
IMAGE_PREFIX=chaitin
ARCH_SUFFIX=
RELEASE=
REGION=-g
MGT_PROXY=0

ARM servers should set ARCH_SUFFIX=-arm. SafeLine installed on ARM requires a Pro license to work properly.

The LTS branch is no longer maintained starting from 9.1.0-LTS, dated August 14, 2025. New installs should normally use the latest release.

5. Launch SafeLine

This process can take several minutes while images are pulled and containers start.

bash
cd "/data/safeline"
docker compose up -d

Login

Use Web UI

Open the management console in your browser. Replace <safeline-ip> with your server IP.

bash
https://<safeline-ip>:9443/

Get administrator account

bash
docker exec safeline-mgt resetadmin

The command prints the initial username and password. Save them immediately.

bash
[SafeLine] Initial username：admin
[SafeLine] Initial password：**********
[SafeLine] Done
SafeLine dashboard after successful login

Cleanup

Uninstallation

If you are sure you no longer need SafeLine, stop the services and remove the install directory. Replace <safeline-directory> with your real directory, such as /data/safeline.

bash
cd <safeline-directory>
docker compose down
rm -rf <safeline-directory>

Still blocked?

If Docker, CPU flags, image pulls, console ports, or login reset commands fail, use the official docs and FAQ as the final troubleshooting source.

Official deploy docsInstallation FAQ