DEV Community

Lia
Lia

Posted on

How to Deploy SafeLine on ARM64 When the Personal Edition Is Not Supported

#arm64 #deployment #waf #license

An ARM server can match the architecture line in the SafeLine install guide and still be the wrong edition for the copy you planned to run. The dependency table names Linux, x86_64, and arm64. A later paragraph in the same manual deploy section is narrower: SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. Those two statements have to be read together before any image pull. Architecture support does not grant Personal Edition support.

This setup guide follows that constraint. It uses only the install, product, and application pages supplied with this brief. Those pages do not publish a price, a checkout flow, or a license-file command, so none of those steps are invented here. They also do not describe a Personal Edition exception for ARM64. If you do not have a Pro license, do not treat an ARM install as a supported Personal Edition deployment.

SafeLine is a self-hosted web application firewall. Deployed in front of an application, it is a reverse proxy: clients reach it first, and it filters, monitors, and blocks malicious HTTP and HTTPS traffic before the origin sees that traffic. The introduction lists defenses for attacks such as SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP flood, and bot abuse. It also lists proactive bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Feature notes add rate limiting, captcha challenge, authentication challenge, and dynamic protection. None of those controls changes the ARM edition rule. Product role and defenses: https://docs.waf.chaitin.com/en/home. Install limits and the ARM license sentence: https://docs.waf.chaitin.com/en/GetStarted/Deploy.

Confirm the host before you change image names

The deploy guide publishes a minimum configuration. You need Linux, Docker 20.10.14 or above, and Docker Compose 2.0.0 or above. The minimum environment is 1 CPU core, 1 GB of memory, and 5 GB of disk. The CPU must provide ssse3. Run the checks the guide prints and keep the output:

  1. uname -m shows the instruction architecture. Compare it with the published list, which names x86_64 and arm64. Use the ARM server settings only when you are deploying to an ARM server, which is the condition the guide uses for ARCH_SUFFIX.
  2. docker version and docker compose version show whether the engine and Compose meet the stated floors.
  3. cat /proc/cpuinfo | grep "processor", free -h, and df -h show CPU count, memory, and disk.
  4. lscpu | grep ssse3 checks the ssse3 instruction.

A failed resource check is an environment problem. Fix Docker, disk, memory, CPU count, or ssse3 before you edit the compose environment. A passed check is still not edition approval. On ARM, the Personal Edition remains unsupported.

The same deploy page marks an automatic installer as recommended. It requires root and uses:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The guide says that after this command finishes, installation has succeeded and you should open the web console. The ARM suffix, the ARM Postgres image, and the Personal Edition limitation are not in that command block. They are in the manual section. Because this article is about that limitation, the numbered procedure below is the manual path, where those settings are written down. If you use the automatic command, you still have to honor the ARM license rule. The sources do not say the script makes the Personal Edition work on ARM.

Numbered setup for an ARM server

Use a directory with at least 5 GB free. The guide says SafeLine writes configuration and data there. Replace every secret placeholder with a value generated on the host, and do not store .env in a public repository.

  1. Install Docker only when it is missing or too old. The guide uses curl -sSL "https://get.docker.com/" | bash. If Docker is already installed, skip this step and re-check the version commands.
  2. Create the data directory with mkdir -p "/data/safeline".
  3. Download the compose file from that directory: cd "/data/safeline" and then wget "https://waf.chaitin.com/release/latest/compose.yaml".
  4. Create .env with touch ".env" and write the documented base values: SAFELINE_DIR=/data/safeline, IMAGE_TAG=latest, MGT_PORT=9443, a Postgres password you choose, SUBNET_PREFIX=172.22.222, IMAGE_PREFIX=chaitin, REGION=-g, and MGT_PROXY=0. Leave RELEASE empty unless you intentionally select LTS. MGT_PORT is the web console port. SUBNET_PREFIX is the internal network address prefix. MGT_PROXY is the number of console proxy layers. The guide says it should be used only when configuring a proxy for the console, and the default 0 means no proxy is configured.
  5. Set the two values the guide gives for an ARM server: ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. The non-ARM sample uses an empty ARCH_SUFFIX and POSTGRES_IMAGE=chaitin/safeline-postgres:15.18. Keep each pair intact. Do not copy the ARM suffix while leaving the non-ARM Postgres image, or the reverse.
  6. Re-read the license rule before the first start. The deploy guide states that SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. Setting the suffix selects the documented ARM images. It does not create a supported Personal Edition install. If you only have the Personal Edition, stop this ARM procedure. The supplied pages do not describe a workaround, a grace mode, or an activation command that removes that limit.
  7. Choose the release track in the same file. Set RELEASE=-lts only if you want the LTS version. The guide says the LTS version will no longer be maintained starting from 9.1.0-LTS (14 August 2025), and it strongly recommends that LTS users upgrade to the latest version. If you have concerns, it recommends upgrading one month after a new version is released. For a new install with no LTS requirement, keep RELEASE empty and IMAGE_TAG=latest.
  8. Generate the secrets from the SafeLine directory and write them into .env. The guide reads 32 random bytes for DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN, builds a 16-character alphanumeric DETECTOR_AES_KEY, and uses a small set_env helper to replace an existing key or append a missing one. It then runs chmod 600 .env. Keep DETECTOR_MGMT_AUTH=on and DETECTOR_UPDATE_VERIFY=on as shown. The sample leaves DETECTOR_UPDATE_PUBLIC_KEY empty. Leave that value as documented instead of inventing a key.
  9. Prepare the paths the guide lists for a new install. Run mkdir -p /data/safeline/resources/run. Apply chmod 700 to /data/safeline/resources/run, /data/safeline/resources/mgt, /data/safeline/resources/sock, and /data/safeline/resources/postgres/data. Confirm chmod 600 /data/safeline/.env. Link the socket with ln -sfn /data/safeline/resources/run/safeline.sock /var/run/safeline.sock.
  10. Start the stack from /data/safeline with docker compose up -d. The guide says this may take several minutes.
  11. Open https://<safeline-ip>:9443/ and reset the administrator account with docker exec safeline-mgt resetadmin. Save the username and password that the command prints. The sample output shows the initial username as admin.

A completed compose command is not evidence that the Personal Edition is supported on ARM. The edition rule is a documented requirement, not something this article can infer from a shell exit code. The guide does not publish the exact console symptom of running ARM without a Pro license, so no failure screenshot or error string is claimed here.

If you are sure you no longer want the installation, enter the SafeLine directory, run docker compose down, and then remove that directory with rm -rf. Do not remove it while you still need the configuration or database data stored there.

Add an application after the edition check

Console login is not the same as protecting a site. The configuration guide says to log into the web admin console, open Applications, and click Add Application. Enter the original domain, hostname, or IP address. Enter the port SafeLine will listen on, such as 80 or 443, and check SSL for an HTTPS app. Enter the upstream, which is the real address that receives forwarded traffic. After saving, resolve the domain you entered to the IP of the server where SafeLine runs, then reach the application through that domain.

That page describes the proxy model in one sequence. SafeLine is a web application firewall developed based on nginx. It receives traffic for the original website, cleans malicious attack traffic, and forwards the remaining traffic to the original application. For a site you own, the guide gives sample requests for SQL injection, XSS, path traversal, code injection, and XXE. Replace the example domain with your own. A blocking page means the request was denied. Open the console attack list and click detail for the event. Those checks are published at https://docs.waf.chaitin.com/en/GetStarted/AddApplication.

Use the named controls from the product introduction only as documented. Rate limiting throttles traffic that exceeds defined limits, including DoS attacks, brute force attempts, traffic surges, and other abuse. Captcha challenge is documented to block crawlers and bots while allowing users who pass the challenge. Authentication challenge requires a password when it is turned on, and blocks visitors who do not enter it. Dynamic protection, when turned on, dynamically encrypts HTML and JS on each visit. These are general product controls, not an ARM-only feature set, and they do not replace the Pro license requirement.

Record the decision in the change note

Close the setup with four facts. First, the host is an ARM server and .env contains ARCH_SUFFIX=-arm plus POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. Second, Docker, Compose, CPU, memory, disk, and ssse3 met the published minimums. Third, the secrets were generated on the host and .env is mode 600. Fourth, the deployment is not relying on the Personal Edition, because the install guide says that edition is not supported on ARM and that a Pro license is required for ARM to work properly.

Questions about install behavior can go to the community channels listed on the product home page. Discord is the primary community contact, with #FAQ for questions and #feedback for feature discussion, in addition to GitHub issues. Those channels are support routes. They do not overwrite the edition sentence in the deploy guide.

Does the arm64 line mean the Personal Edition can run on ARM?

No. The dependency table answers the architecture question and includes arm64 beside x86_64. The manual ARM paragraph answers the edition question: a Pro license is required for SafeLine installed on ARM to work properly, and the Personal Edition is not supported on ARM. A matching uname -m result only identifies the machine. It does not approve an edition.

Which environment values are the ARM switch?

Set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. The generic sample uses an empty ARCH_SUFFIX and POSTGRES_IMAGE=chaitin/safeline-postgres:15.18. Those two ARM assignments are the documented image switch. They are not a license bypass, and the deploy guide does not say that either value enables the Personal Edition.

What belongs on the pre-start checklist?

Confirm Linux, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, at least 1 core, 1 GB of memory, 5 GB of disk, and ssse3, using the commands in the deploy guide. Confirm the generated management and detector secrets, mode 600 on .env, mode 700 on the listed resource directories, and the socket symlink. Confirm the ARM image pair. Confirm that the plan does not depend on the Personal Edition.

How is the first console account created?

After docker compose up -d, open https://<safeline-ip>:9443/ and run docker exec safeline-mgt resetadmin. The guide says the command prints the initial username and password, and that you must remember them. The sample environment uses MGT_PORT=9443, which matches that URL. Store the password outside the shell history you share with other people.

What proves an application is actually behind the firewall?

Add it in the console with domain, listen port, and upstream, then point that domain at the SafeLine server, as the configuration guide describes. From a site you control, try one of the documented attack requests and look for the blocking page. Then open the attack list and click detail. That result shows the proxy denied the test request. It does not show that a Personal Edition entitlement is valid on ARM, and it does not remove the Pro license requirement stated in the install guide.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)