DEV Community

Lia
Lia

Posted on

How to Install a Free WAF on Docker Ubuntu (Complete Guide)

#devops #security #tutorial #webdev

Before You Start 

# Make sure Docker is installed
docker --version          # Should be 20.10.6+
docker compose version    # Should be 2.0.0+

# Make sure you have room
df -h /                   # Need at least 5 GB free
free -h                   # Need at least 1 GB available RAM
Enter fullscreen mode Exit fullscreen mode

Install SafeLine 

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

This single command pulls the Docker images, creates the Compose file, starts all containers, and runs the initial setup — all in 2-3 minutes.

First Login

Open https://<your-server-ip>:9443 in your browser. Scan the TOTP QR code with Google Authenticator or Authy, verify with the 6-digit code, then set your admin password.

Add a Site

  1. In the dashboard sidebar, click Sites
  2. Click Add Site
  3. Fill in your domain, backend address (e.g., localhost:3000), and port
  4. Click save — your site is now protected

Point Your Domain

If SafeLine is your primary reverse proxy on ports 80/443, update your DNS A record. If behind Nginx or Caddy, forward traffic to SafeLine's port.

Verify it works:

curl "http://your-server-ip/?id=1' OR '1'='1"
Enter fullscreen mode Exit fullscreen mode

Open Attack Logs — you will see the blocked SQL injection attempt.

Quick Config After Install

Rate limit your login page. Set 5 req/min on /wp-login.php or /login — stops brute force instantly.

Block noisy countries. Geo-block regions you do not serve. Most scanner traffic comes from countries you have no business with.

Enable bot protection on forms. Toggle on for login, signup, checkout pages. Suspicious patterns get JS or Captcha challenges.

Check the dashboard tomorrow. In 24 hours you will see automated scanners, SQL injection probes, and path traversal attempts — all blocked without a single rule written.

Keeping It Updated 

docker compose -f /path/to/safeline/docker-compose.yml pull
docker compose -f /path/to/safeline/docker-compose.yml up -d
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

If SafeLine goes down, traffic stops reaching your app. Quick fix:

docker compose -f /path/to/safeline/docker-compose.yml ps
docker compose -f /path/to/safeline/docker-compose.yml restart
Enter fullscreen mode Exit fullscreen mode

To bypass temporarily, point DNS directly at your app.

FAQ

Can I install this on an existing server without breaking anything?

Yes. Run on a custom port and keep your current web server on 80/443. SafeLine only intercepts what you route through it.

Does SafeLine need a dedicated server?

No. Community Edition uses about 1 GB RAM. A $10/month VPS with 2 GB RAM runs SafeLine alongside Node.js, Python, or PHP apps comfortably.

What happens to my existing SSL certificates?

Nothing changes if you terminate TLS at your current proxy. SafeLine sits behind it. If you want SafeLine to handle TLS, upload your cert or enable Let's Encrypt in the dashboard.

Is this production-ready for client projects?

Absolutely. Same detection engine as the paid Pro version. Community Edition protects 1M+ websites worldwide. The limits are on apps (10), throughput (800 QPS), and support type. Most client sites never hit those limits.

What is running on your Ubuntu server right now that could use a WAF in front of it?

Top comments (0)