Deploy SafeLine WAF on Ubuntu: A Step-by-Step Guide

Ubuntu is one of the most common hosts for self-hosted services, and SafeLine
runs happily on it. Here is a clean deployment path.

Prerequisites

• A fresh or existing Ubuntu 20.04/22.04 server.
• Docker installed (sudo apt install docker.io).
• Network access so the installer can pull images.

Install SafeLine

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The script detects the environment and brings up the SafeLine containers.

Access and configure

Open https://<server-ip>:9443 in your browser. Create the admin account, then add the site
you want to protect by setting its upstream to your real app (for example a service on
127.0.0.1:8080).

Place it in front of your app

Update your reverse proxy or DNS so traffic reaches SafeLine first. SafeLine's semantic-analysis
engine inspects each request and forwards clean traffic to your upstream, blocking SQL
injection, XSS, and automated abuse.

Hardening tips

• Put the dashboard behind a strong admin password and, ideally, an allowlisted IP.
• Set container restart policies.
• Watch the dashboard's logs for the first days to tune any edge cases.

FAQ

Does it work with UFW/iptables?

Yes; just ensure the SafeLine listener port is reachable.

Minimum specs?

1 CPU, 1 GB RAM, 5 GB disk.

Free?

The Community Edition is free for 10 apps / 800 QPS.

Wrap Up

If you want a self-hosted WAF you fully control, SafeLine is worth a look. It sits in
front of your existing stack as a container, uses a semantic-analysis engine to catch SQL
injection, XSS, and bot abuse with very low false positives, and the Community Edition is
free.

• Official docs: https://docs.waf.chaitin.com/en/home
• GitHub: https://github.com/chaitin/SafeLine
• Live demo: https://demo.waf.chaitin.com:9443/statistics

Deploy it in minutes:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en