DEV Community

禾
禾

Posted on

Dedicated Directory vs Shared Path: How to Uninstall a Self-Hosted WAF

#uninstall #directory #proxy #checklist

If you need to uninstall a self-hosted WAF and remove its data directory, decide where that directory lives before you run a delete command. SafeLine filters and monitors HTTP traffic between a web application and the Internet. It is a reverse proxy: clients pass through the WAF before they reach the origin server (https://docs.waf.chaitin.com/en/home). During setup, SafeLine writes configuration and data into a directory you create. The deploy guide then gives a complete uninstall: enter that directory, run docker compose down, and remove the directory with rm -rf (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Those commands have a very different blast radius depending on whether the data directory is dedicated or shared.

Choice A: dedicated directory

The manual path creates /data/safeline, downloads compose.yaml there, and sets SAFELINE_DIR=/data/safeline in .env. The same page says you need at least 5 GB of disk for this directory. It also runs chmod 700 on /data/safeline/resources/run, /data/safeline/resources/mgt, /data/safeline/resources/sock, and /data/safeline/resources/postgres/data, plus chmod 600 on .env. That file holds POSTGRES_PASSWORD, DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, and DETECTOR_AES_KEY, and the sample sets MGT_PORT to 9443. Here the compose project and the data root are one path. The uninstall placeholder <safeline-directory> is that path, not a name you invent at cleanup time.

Choose this placement when you want removal to match the install tree. You can confirm the folder is not an application repository, compare its size with the 5 GB note, and know that rm -rf after docker compose down is aimed at the WAF directory the guide told SafeLine to use.

Choice B: shared or relocated path

A shared or relocated layout splits or moves those roles. The compose file might sit in a home directory, a checkout, or next to application code, while SAFELINE_DIR still points at /data/safeline. Or you might point SAFELINE_DIR at another mount so the 5 GB requirement lands on a different disk. The uninstall section does not hardcode /data/safeline. It tells you to enter <safeline-directory> and delete <safeline-directory>. If you delete only the folder that contains compose.yaml, a separate data root can remain, still holding configuration and the Postgres data path. If you delete a parent directory that also contains the origin, you remove more than the WAF.

The install steps also create a symlink with ln -sfn /data/safeline/resources/run/safeline.sock /var/run/safeline.sock. The uninstall section does not mention that link. On a relocated data root the target may not even be the folder you think you are deleting. Custom placement is defensible for disk layout, but only if you write down the compose directory, the SAFELINE_DIR value, and any host path that lives outside the tree before you remove anything.

What the documented removal covers

docker compose down stops the project. rm -rf <safeline-directory> removes the SafeLine data directory. That is the full uninstall published in the deploy guide. It does not uninstall Docker. Docker 20.10.14 or above and Docker Compose 2.0.0 or above are install dependencies on the host, not contents of the WAF directory. The guide also does not say that deleting the directory removes local images referenced from .env, such as the POSTGRES_IMAGE setting. Do not add undocumented flags and call them part of the product procedure. Run the stop command from the directory that still contains the compose file, then delete the data path. If you delete the compose directory first, you no longer have the project file the stop command is documented to run from.

Cut traffic over before either choice

SafeLine receives traffic for the original site, blocks malicious requests, and forwards the rest to the upstream. To protect an application you set domain, listen port, and upstream in the console, then resolve that domain to the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Uninstall does not change DNS. If the name still points at the WAF host, removing the proxy removes the front end the application guide told clients to use. Point the record at the origin, or at another reverse proxy you already operate, and confirm an ordinary request succeeds before docker compose down.

Then pick retention. Leave the directory in place if you only want the stack stopped and may later run docker compose up -d from the same files. Remove it when you are sure you no longer want this installation. If you still need passwords or tokens, copy .env outside the tree first. The console URL in the guide is https://<safeline-ip>:9443/ when the sample port is unchanged, and that console goes away with the stack. The deploy guide says configuration and data are written into the SafeLine directory, and the manual layout puts Postgres data under that directory. Treat application objects and attack details you viewed in the console as part of that tree, not as a copy that survives rm -rf.

Dedicated directory versus shared path is the placement choice that decides whether the published uninstall is bounded. Choice A keeps the compose file, SAFELINE_DIR, and data on one root, so removal matches the install guide. Choice B can fit another disk, but it demands an explicit map of compose path, data path, the /var/run/safeline.sock symlink, and DNS. In both cases the product steps stay the same: stop with docker compose down, then remove only the SafeLine directory.

Should I only stop the stack, or also remove the data directory?

Stop with docker compose down if you might start the same installation again. Remove <safeline-directory> when you no longer want SafeLine. The deploy guide lists both, in that order, for a complete uninstall. Stopping alone leaves .env secrets and the data tree on disk.

What if my directory is not /data/safeline?

/data/safeline is the manual example, including the sample SAFELINE_DIR. The uninstall placeholder is the directory you actually used. Match the compose project to SAFELINE_DIR. If they differ, identify both paths before you delete either one, or you will leave a second data root behind or erase an unrelated folder.

Will uninstall remove Docker or the origin application?

The published commands stop the SafeLine compose project and delete its directory. They do not uninstall Docker or Docker Compose. They do not delete the origin application unless that application was stored inside the SafeLine directory. The site can still become unreachable if DNS still targets the WAF host, because the application guide places SafeLine in front of the origin.

What should I save before the directory is removed?

Save .env if you still need POSTGRES_PASSWORD or the detector and management tokens. The install guide sets that file to mode 600, which fits credential material. Keep the copy outside the path you are about to remove. Do not assume console history is stored somewhere else. The deploy guide ties configuration and data to the SafeLine directory.

Which placement is easier to retire later?

A dedicated directory is easier to retire. The compose file, SAFELINE_DIR, and the data path agree, so rm -rf has one boundary. A shared or relocated path can be a valid disk choice, but leftovers are easier to miss: a second data root, a symlink under /var/run, or application files mixed into the WAF tree. If you do not use /data/safeline, record those paths when you install, not while you are deleting.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)