DEV Community

禾
禾

Posted on

A vs B: Moving SafeLine LTS to the Latest Release — Jump Now or Wait a Month

#migration #upgrade #install #checklist

SafeLine is a self-hosted web application firewall that filters and monitors HTTP traffic between a web application and the internet, acting as a reverse proxy that cleans malicious requests before forwarding safe traffic to the origin server (https://docs.waf.chaitin.com/en/home). One of the first configuration decisions you make when deploying it is which software channel your instance follows: the latest release channel or the LTS channel. If you are still on LTS, that decision needs revisiting, because the deploy documentation states that the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025) and that LTS users are strongly recommended to upgrade to the latest version (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

The two configurations compared

The channel is selected by the RELEASE variable in the SafeLine .env file, which lives in the directory you created for SafeLine during deployment (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

  • Configuration A, latest release channel: leave RELEASE empty, which is the default shown in the sample .env file. This keeps the instance on the current latest release and matches the maintainers' upgrade recommendation.
  • Configuration B, LTS channel: set RELEASE=-lts. This pins the instance to the LTS line, which is exactly the state LTS users are being asked to leave because that line has reached end of maintenance.

A related variable is IMAGE_TAG, which the documentation describes as the SafeLine version to be used. With the sample value of latest, the instance pulls the latest available image for the selected channel. Moving from LTS to latest therefore comes down to changing RELEASE=-lts back to RELEASE= in .env while keeping IMAGE_TAG=latest, then re-launching the stack.

Why the comparison matters

The core tradeoff is maintenance versus immediacy. The LTS channel was the conservative choice: it favored stability and a slower pace of change. That tradeoff is now inverted, because a channel that is no longer maintained stops receiving the fixes and improvements a WAF needs to stay effective against evolving attacks. The maintainers' guidance reflects this: LTS users should move to latest, and if you have concerns, upgrade one month after the release of a new version so the release has had some field exposure first (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Moving your install: a checklist

The supplied documentation does not publish a dedicated one-command migration page for this exact scenario, so treat the following as a decision checklist grounded in the documented variables and launch commands rather than a promised integration.

  1. Locate the SafeLine directory that holds your .env file.
  2. Open .env and change RELEASE=-lts to RELEASE=.
  3. Confirm IMAGE_TAG=latest so the instance pulls the current release.
  4. Re-run the documented launch command, docker compose up -d, from the SafeLine directory (https://docs.waf.chaitin.com/en/GetStarted/Deploy).
  5. Open the web console at https://:9443/ to verify the instance is running.

Keep in mind the documented deployment prerequisites before you touch anything: Linux on x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 core CPU, 1 GB memory, and 5 GB disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Also note that ARM installs require a Pro license, as the Personal Edition is not supported on ARM.

Now or one month later?

If your environment tolerates the maintenance gap on the LTS channel, follow the documented one-month guidance and schedule the move for a maintenance window. If you would rather not run an unmaintained WAF channel, move to the latest release as soon as you have backed up .env and your SafeLine data directory. Either way, the destination is the same; only the timing differs.

Is SafeLine LTS still maintained?

No. The deploy guide states that the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and that LTS users are strongly recommended to upgrade to the latest version (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

What is the difference between RELEASE= and RELEASE=-lts?

In the SafeLine .env file, RELEASE selects the channel. An empty RELEASE keeps the instance on the latest release channel, while RELEASE=-lts selects the LTS version. The sample .env also sets IMAGE_TAG=latest to control which version tag is used (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

How do I move my install from LTS to the latest release?

Use the checklist above: edit RELEASE in .env, keep IMAGE_TAG=latest, run docker compose up -d from the SafeLine directory, and verify through the web console. The official guide documents these variables and commands but does not publish a separate migration page, so back up .env and data first.

Will changing the channel erase my configuration or data?

The deployment guide notes that SafeLine writes its configuration and data to the directory you created for it, so a channel change does not require recreating that directory. Still, the guide does not document a dedicated migration flow, so backing up .env and the data directory before editing is the safest practice.

Should I move now or wait one month after a new release?

If you have concerns about stability, the documentation recommends upgrading one month after a new release is published so it has accumulated field exposure. Otherwise, move sooner, since the LTS channel is no longer maintained.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)