DEV Community

禾
禾

Posted on

Official Manager Script vs Manual Compose: Which Linux Install Should You Run?

#linux #install #waf #docker

The official Linux manager script is the recommended automatic install for SafeLine, but I do not run it until the host has passed the checks in the deploy guide. SafeLine is a self-hosted web application firewall. It filters and monitors HTTP traffic between a web application and the Internet, and it is deployed as a reverse proxy so clients pass through it before they reach the origin. That design makes the install host part of the request path, which is why a one-line script still needs a preflight.

The deploy guide publishes one automatic command, and it requires root privileges. The English form is:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The same page says that after the command is executed, the installation is successful, and the next step is to use the web UI directly. I read that as a completion rule for the script, not as a claim that a site is already protected. The guide does not document extra switches on that command, so I do not add flags for port, directory, architecture, or release channel.

Match the published minimums first

Before the script, I confirm the dependency table from the install document at https://docs.waf.chaitin.com/en/GetStarted/Deploy. The operating system is Linux. The instruction architecture is x86_64 or arm64. Docker must be 20.10.14 or above, and Docker Compose must be 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must support ssse3.

The guide gives these confirmation commands:

uname -m
docker version
docker compose version
cat /proc/cpuinfo| grep "processor"
free -h
df -h
lscpu | grep ssse3

I want uname -m to print x86_64 or arm64. I want the Docker and Compose versions at or above the stated floors. I want processor, memory, and disk output that meets the minimum environment, and I want lscpu | grep ssse3 to return a match. If Docker is not installed, the manual section of that same guide shows curl -sSL "https://get.docker.com/" | bash and then a separate compose install. That manual path is documented. It is not something I infer from the manager script, because the automatic section does not describe the files the script writes.

Treat script success as a console, not a protected app

I run the manager script as root on the Linux machine that will stay in front of the application. When it finishes, I follow the documented web UI step and open https://:9443/. The manual environment example uses MGT_PORT=9443, which is the same console port named in that UI step.

The practical check that management is up is the administrator reset command in the deploy guide:

docker exec safeline-mgt resetadmin

On success, the output includes an initial username of admin and an initial password. I record that password before closing the session, then log in with it. If the console does not load, or the reset command cannot find safeline-mgt, I do not describe the script run as finished just because the shell returned. The guide's own success path ends at the web UI and this account step.

A logged-in console is still not a shielded site. The application document at https://docs.waf.chaitin.com/en/GetStarted/AddApplication says SafeLine is developed based on nginx and acts as an HTTP or HTTPS reverse proxy. It receives traffic for the original website, cleans malicious traffic, and forwards the remaining traffic to the original application. In the console, open Applications, click Add Application, and enter Domain, Port, and Upstream. Domain may be a domain name, a hostname, or an IP address. Port is the port SafeLine will listen on, such as 80 or 443, and HTTPS applications need the SSL option checked. Upstream is the real address used to forward traffic to the original app. After saving, resolve that domain to the IP of the SafeLine server. Clients reach the firewall only after that resolution points at this host.

Decide where the manual compose record is safer

Automatic deploy is the recommended path when the host already satisfies the dependency table and I want the documented one-command install. I switch to the manual record when I need the directory, environment file, and tokens written out in the guide. That record starts with a SafeLine directory, at least 5 GB of disk, a downloaded compose.yaml, and a .env file. The documented keys include the data directory, image tag, management port, Postgres password, subnet prefix, image prefix, architecture suffix, release suffix, and region, plus generated detector and management secrets. The guide then starts the stack with docker compose up -d.

Two notes in that manual section should be decided before either path. If the server is ARM, the guide says to set ARCH_SUFFIX to -arm and to use the ARM Postgres image it names. It also states that SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. An arm64 result from uname -m does not waive that rule, and nothing in the automatic command says the manager script does. The LTS setting is also a manual environment value. The guide says the LTS version will no longer be maintained starting from 9.1.0-LTS on 14 August 2025, and it strongly recommends that LTS users upgrade to the latest version. If there are concerns, it recommends waiting one month after a new version is released before upgrading. For a new host, I keep the default latest install unless I have a reason to follow a release path the document still describes.

Removal is a separate, explicit procedure. Enter the SafeLine directory, run docker compose down, and delete that directory only when you are sure you no longer want the installation or its data. I do not use those steps to fix a console password. The reset command is the documented way to recover the initial admin account.

What the product can enforce after traffic actually flows through it is listed on the product page at https://docs.waf.chaitin.com/en/home. SafeLine is documented to defend against web attacks such as SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. Core capabilities named there include web-attack defense, proactive bot-abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Feature descriptions also cover rate limiting, CAPTCHA challenge, authentication challenge, and dynamic protection of HTML and JS. None of those controls run for a site that still points at the old origin.

Does the manager script remove the need to check Docker?

No. Docker 20.10.14 or above and Docker Compose 2.0.0 or above are published dependencies for a SafeLine instance. Confirm both versions before you run the script, even though automatic deploy is marked recommended.

What is the only automatic command in the install guide?

The recommended command is bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en, and it requires root privileges. I do not append undocumented options for architecture or an LTS release.

How do I know the install is actually usable?

Open https://:9443/ and run docker exec safeline-mgt resetadmin. The guide says a successful reset prints the initial admin username and password. Then log in with that password.

Does finishing the script protect my current website?

No. You still add an application with a domain, a listen port, and an upstream, then resolve the domain to the SafeLine server. Until DNS points at that server, visitors are not passing through the reverse proxy.

What changes on an ARM Linux host?

arm64 is a supported instruction architecture, but the deploy guide says SafeLine on ARM requires a Pro license and that the Personal Edition is not supported on ARM. Confirm that constraint before you rely on the host for live traffic.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)