DEV Community

禾
禾

Posted on

x86_64 Proxy vs ARM64 Host: Where to Place SafeLine

#arm64 #deployment #waf #license

Placing a web application firewall is a routing decision before it is a tuning decision. If the application already runs on an ARM64 server, the tempting layout is to install the filter on that same box. The deploy guide draws a hard line there: SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. The other layout is not a different inspection model. It is a different place to terminate HTTP. Run the WAF on an x86_64 Linux host that meets the documented minimums, and send the ARM application traffic through it as an upstream.

That is the comparison. Choice A is a separate x86_64 reverse proxy. Choice B is an install on the ARM64 host. Both use the same proxy pattern. The documented Personal Edition block is attached to ARM installs, so Choice A is how you avoid that block without pretending the guide named a special x86 license plan.

What the deploy guide actually limits

The install requirements are short and easy to misread. SafeLine expects Linux, and the listed instruction architectures are x86_64 and arm64. Software dependencies are Docker 20.10.14 or above and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU list also includes ssse3. The guide tells you to confirm the machine with uname -m, docker version, docker compose version, a processor count, free -h, df -h, and lscpu | grep ssse3. Those checks apply before you argue about placement. A host that fails them is not a candidate, on either architecture.

Architecture support is not edition support. For an ARM server, the manual notes say to set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. In the sample environment file, ARCH_SUFFIX is empty and the Postgres image is chaitin/safeline-postgres:15.18. Immediately after the ARM image lines, the guide states that an ARM install requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. There is no documented flag that turns Personal Edition into an ARM build. RELEASE=-lts only selects the LTS channel. That channel is a separate warning: LTS will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and LTS users are told to upgrade to the latest version. It is not described as a license workaround. The constraints above are from the SafeLine deploy guide.

Choice A: terminate traffic on a separate x86_64 proxy

Choice A keeps the application on ARM64 and moves only the WAF. SafeLine is a reverse proxy developed on nginx. It receives traffic for the original site, removes malicious HTTP, and forwards the remaining traffic to the real application. In the admin console you add an application with three fields that decide the path: Domain, Port, and Upstream. Domain is the name, hostname, or address clients use. Port is what SafeLine listens on, such as 80 or 443, with SSL checked for HTTPS applications. Upstream is the real address of the original app. After saving, resolve that domain to the IP of the server where SafeLine runs. The application guide is explicit about that DNS step.

On the x86_64 proxy, uname -m should report x86_64. Keep ARCH_SUFFIX empty, as in the published sample, and do not switch Postgres to the ARM image tag. The Personal Edition restriction is stated for ARM installs. The guide does not attach that same sentence to the x86_64 path. Adding an x86_64 host that meets the minimums is therefore a placement fix, not a claim that any license name was priced or guaranteed in the install page.

This layout has ordinary operational cost. You patch and monitor a second Linux host. That host still needs Docker, Compose, ssse3, and the 1 core / 1 GB / 5 GB floor, with at least 5 GB where SafeLine writes configuration and data. The upstream must be reachable from the WAF. The public name must resolve to the WAF. If DNS still points at the ARM server while SafeLine listens elsewhere, clients never hit the filter. The console stays on the WAF host. The sample environment uses MGT_PORT=9443, and the guide tells you to open https://<safeline-ip>:9443/.

Choice A does not need an ARM-specific connector. It uses the reverse-proxy fields the product already documents. If the ARM application cannot be reached as an upstream from the x86_64 host, this placement is not ready. Do not add an undocumented tunnel, agent, or mesh and call it supported.

Choice B: install on the ARM64 host

Choice B is the colocated layout. The WAF and the application share an ARM64 server, or every machine you can use is ARM. Here uname -m reports arm64, and the manual architecture lines are mandatory. Set ARCH_SUFFIX=-arm. Set POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. Then treat the license line as a gate, not a warning you can ignore: a Pro license is required for an ARM install to work properly, and Personal Edition is not supported on ARM. If you only have Personal Edition, this placement is the wrong choice.

Colocation still uses the same application form. Domain and port describe the listener. Upstream is still the real address of the original app. DNS for that domain must resolve to the SafeLine server, which in this layout is the ARM server. The diagram is simpler. The license position is not. Capacity is also coupled to that same host, and the only published floor is still 1 core, 1 GB of memory, and 5 GB of disk. The docs do not publish an ARM sizing curve, so meeting the minimum is a pass/fail check, not a forecast.

The automatic installer is a root-level command that finishes in the web UI. The manual path is Docker Compose from a directory such as /data/safeline, started with docker compose up -d. Neither path is described as removing the ARM edition requirement. Pick the installer you can operate. Do not pick it to dodge the license line.

A practical way to choose

Measure the candidate WAF host, not the application host.

  1. Run uname -m. If the result is arm64 and you do not have a Pro license, stop. Personal Edition is not a supported ARM install.
  2. If the result is x86_64, confirm Docker 20.10.14 or newer, Docker Compose 2.0.0 or newer, ssse3, and at least 1 core, 1 GB of memory, and 5 GB of disk.
  3. Confirm the original app can be entered as an upstream from that host, and that you can point the public domain at the WAF address.
  4. Only if every acceptable host is ARM, plan on a Pro license, then set the ARM suffix and the ARM Postgres image before you start Compose.
  5. Do not set RELEASE=-lts because you hoped an older channel would ignore architecture. LTS is a version choice, and the guide says that line is no longer maintained from 9.1.0-LTS (14 August 2025).

After either placement, prove the hop with the documented probes, using your own domain in place of the example: a SQL injection query, an XSS payload, a path traversal string, a code injection probe, and an XXE probe. A block page means the request reached SafeLine and was denied. Open the console attack list and use the detail view. If the request reaches the application unchanged, the domain is still aimed at the wrong address, or clients are not using the listener port.

CPU does not change the product model. The introduction describes a reverse proxy that filters and monitors HTTP traffic, with attack defense, proactive bot defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. The feature list also includes rate limiting against abuse such as denial-of-service attempts, brute force, and traffic surges, plus a CAPTCHA challenge, an authentication challenge, and dynamic HTML and JS encryption when those controls are turned on. Those controls sit on the WAF hop. They do not move the Personal Edition line. Read the behavior in the product introduction, then decide placement from the deploy guide.

FAQ

Does Personal Edition work on an ARM64 SafeLine install?

No. The deploy guide says an ARM install requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. Listing arm64 as an instruction architecture does not remove that sentence.

Can the application stay on ARM if the WAF runs on x86_64?

Yes, if you use the documented reverse-proxy fields. Domain and port belong to the SafeLine listener. Upstream is the real address of the ARM application. Resolve the domain to the x86_64 WAF host. That is ordinary proxy placement, not a separate ARM integration.

Which settings differ on an ARM server?

Set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. The non-ARM sample leaves ARCH_SUFFIX empty and uses chaitin/safeline-postgres:15.18. The shared floor does not change: Linux, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, ssse3, and at least 1 core, 1 GB of memory, and 5 GB of disk.

Does choosing LTS avoid the ARM Personal Edition limit?

No. RELEASE=-lts selects the LTS version channel. The guide says LTS will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and it recommends upgrading to the latest version. It does not say LTS changes edition support.

What should I verify before I cut DNS over?

Confirm uname -m, the Docker and Compose versions, ssse3, and at least 5 GB of disk. Confirm that the domain resolves to the SafeLine host and that the upstream is the real application address. Then send the documented attack probes and look for a block page plus an entry in the console attack list. If those probes never appear, clients are not passing through the WAF.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)