DEV Community

禾
禾

Posted on

Direct Host vs Proxied Console: How to Reset the WAF Admin Account Inside Docker

#docker #waf #admin #reset

Forgot the SafeLine console password and opened the login page first? The documented recovery is not a form on that page. It is a Docker command against the management container. The choice that matters is placement: a console published directly by the Docker host, or a console reached through extra proxy layers. Both layouts use the same reset command. They do not use the same machine, the same URL, or the same failure checks.

SafeLine is a self-hosted web application firewall. Deployed in front of an application, it acts as a reverse proxy: clients reach SafeLine, SafeLine filters and monitors HTTP and HTTPS traffic, and safe traffic is forwarded to the application. The product documentation describes defenses for common web attacks, rate limiting, CAPTCHA and authentication challenges, and dynamic HTML and JS protection (https://docs.waf.chaitin.com/en/home). Application setup is separate from account recovery. In the console you add an application with a domain, a listen port, and an upstream, then point that domain at the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

The install guide supports Linux, x86_64 or arm64, Docker 20.10.14 or newer, and Docker Compose 2.0.0 or newer. After install, the administrator account is printed by one command: docker exec safeline-mgt resetadmin (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Direct host placement

Use this placement when operators open the console on the SafeLine host itself. In the manual Compose layout, MGT_PORT is the web console port. The guide shows the console at https://:9443/. MGT_PROXY stays at 0. The deploy guide defines that value as no console proxy, and says the setting should be used only when you are configuring a proxy for the console (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Recovery then stays inside one trust boundary:

  1. Start from a running stack. The launch step is docker compose up -d in the SafeLine directory. A common directory is /data/safeline, stored in SAFELINE_DIR.
  2. On that Docker host, run docker exec safeline-mgt resetadmin.
  3. Record the output at once. The guide says you must remember it. It prints an initial username of admin and an initial password.
  4. Sign in at https://:9443/, or at the host and port you actually set in MGT_PORT.

The command is typed on the host. Docker runs it inside the safeline-mgt container. That is the documented meaning of resetting the WAF admin account inside Docker. The guide does not show a console button, a SQL update, or a second admin username.

This placement is easier to audit. The person who can reset the account is the person who can see the container. That person can also open the published console port, unless a host firewall blocks 9443 or your custom MGT_PORT. If login fails, check the port and the latest printed password before you touch data files.

Proxied console placement

Use this placement when the console is published through extra proxy layers. MGT_PROXY is that layer count. Leave it at 0 unless you are actually configuring a console proxy. Raising it does not move account recovery onto the proxy.

The reset command is still docker exec safeline-mgt resetadmin, and it still has to run where that container exists. A laptop, a bastion, or the outer proxy host cannot run it unless that machine's Docker daemon has safeline-mgt. Browser access to a proxied login page is not Docker access.

After the command prints the initial username and password, sign in through the console address you configured for that proxy layout. Do not assume the default :9443 page is the right hop just because it is the example in a direct install. The guide does not define a different container name, a different reset binary, or a password-reset API for the proxied case.

The failure mode is also different. Operators see the proxied page, forget the password, and look for a reset on the page. The page is only the client. The new password is printed by the management container. If the proxy hop is wrong, a valid password still fails. Correct the console path you configured. Do not treat a routing mistake as a reason to reinstall.

Shared checks before you run it

Direct and proxied consoles share the same dangerous mix-up: password recovery is not uninstall. Uninstall is docker compose down in the SafeLine directory, then removing that directory. The guide presents those steps only when you are sure you no longer want the installation (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Removing /data/safeline, or any other SAFELINE_DIR, deletes the install. It does not document a cleaner admin reset.

Keep install secrets separate too. The manual path writes .env, sets POSTGRES_PASSWORD, and generates DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, and DETECTOR_AES_KEY, then restricts .env with chmod 600. Those values are for a new or existing install. The admin username and password are the lines printed by resetadmin. The guide does not say to rotate those tokens because a console login was forgotten.

Automatic install and manual install meet at the same account step. Automatic install is the recommended manager.sh command. Manual install is Docker, a directory, compose.yaml, .env, and docker compose up -d. Both then send you to the web console and to docker exec safeline-mgt resetadmin (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Use this checklist on either placement:

  • Confirm Linux, Docker, and Docker Compose meet the versions above, on the host that should own the stack.
  • Confirm safeline-mgt is on this Docker daemon. If it is missing, you are on the wrong host.
  • Run the reset only after the stack is up. The launch command is docker compose up -d.
  • Copy the initial username and password when they are printed. The guide tells you to remember that content.
  • Match the login URL to the placement: direct MGT_PORT, or the proxied console you configured with MGT_PROXY.
  • Do not delete the data directory, and do not rewrite .env, as a substitute for the admin command.

When you are in, check Applications before you test traffic. Adding a site means a domain, a listen port, an upstream, and DNS pointed at the SafeLine server (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The reset command output does not document a change to those applications. Verify the page. Do not infer a side effect the guide never states.

Does the admin reset run inside Docker?

Yes, in the only way the install guide documents. You run docker exec safeline-mgt resetadmin on the Docker host, and the command executes in the safeline-mgt container. There is no documented browser flow that replaces it.

Can console access alone reset the admin account?

No. Opening https://:9443/, or a proxied console URL, only gets you the login page. The documented command needs the Docker host that has safeline-mgt. A proxy in front of the console does not add a second recovery command.

Do MGT_PORT or MGT_PROXY change the reset command?

No. MGT_PORT is the console port. MGT_PROXY is the number of console proxy layers and defaults to 0. Neither setting is documented as a replacement for docker exec safeline-mgt resetadmin. They only change where you sign in after the password is printed.

Should I remove the data directory if the password is lost?

No. Directory removal belongs to uninstall, after docker compose down. Use that only when you intend to delete the installation. For a lost console login, reset the admin account on the running management container and keep SAFELINE_DIR in place.

What if the new password is rejected?

Check three facts before you change anything else. You used the password from the latest command output. You are on the Docker host that actually ran it. You opened the console URL that matches this placement, including a non-default MGT_PORT or a configured proxy hop. A rejected login is not a documented reason to regenerate DETECTOR_MGMT_TOKEN or to reinstall.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)