DEV Community

Lia
Lia

Posted on

How to Verify WAF Docker Compose and SSSE3 Requirements

#docker #compose #ssse3 #deploy

Before a self-hosted web application firewall is placed in front of an application, the host has to match the published install dependencies. SafeLine filters and monitors HTTP traffic between a web application and the Internet, and it is deployed as a reverse proxy so clients pass through it before they reach the origin server (https://docs.waf.chaitin.com/en/home). That protection never starts if the machine fails the dependency table. The deploy guide requires Linux, an x86_64 or arm64 instruction architecture, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, at least 1 CPU core, 1 GB of memory, 5 GB of disk, and a CPU with ssse3 (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Verifying Docker Compose and the ssse3 flag is the first gate, not a cleanup task after containers are already created.

Match each requirement to the published command

The same deploy page lists the commands used to confirm the server configuration. Run them on the host that will run the WAF, in a shell that can see the Docker installation you intend to use:

uname -m
docker version
docker compose version
cat /proc/cpuinfo | grep "processor"
free -h
df -h
lscpu | grep ssse3

Read each result against one row. uname -m is the instruction-architecture check. docker version is the Docker check. docker compose version is the Compose check. The processor, memory, and disk commands cover the minimum environment. lscpu | grep ssse3 is the CPU instruction check. Do not replace these with a different inventory script and then treat the requirement as confirmed. The guide publishes these commands because they map directly to the dependency table.

Confirm Docker and Docker Compose before any installer

Docker must be version 20.10.14 or above. Docker Compose must be version 2.0.0 or above. The documented Compose command is docker compose version, the plugin-style form with a space, not an undocumented substitute. If the command is missing, or the version it prints is older than 2.0.0, stop. If docker version is missing or older than 20.10.14, stop as well.

Both install paths assume those floors are already true. The recommended automatic deploy is a root-owned script:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

The guide says a completed run means installation succeeded, and that you then open the web UI. It does not say the script is a probe for missing Docker or an old Compose plugin. On a fresh virtual machine, run the version commands first.

The manual path is stricter about order. It installs Docker if needed, creates a directory such as /data/safeline, downloads compose.yaml, writes .env, generates tokens, sets permissions, and only then runs docker compose up -d. That launch command can take several minutes. It is the wrong moment to learn that Compose is below 2.0.0. Keep the version output with your change record so a later operator can see why the host was accepted.

Treat architecture and ssse3 as separate rows

Supported instruction architectures are x86_64 and arm64. If uname -m prints something else, the host is outside the published matrix. Do not download the compose file or start the stack in the hope that a container image will hide the mismatch.

The ssse3 check is separate. lscpu | grep ssse3 looks for that flag in the CPU feature list. A matching line confirms the flag is visible to lscpu. No matching line means the documented CPU requirement is not confirmed. The deploy guide does not list a waiver, a software fallback, or a Compose setting that replaces this check. Save the command output either way.

An arm64 result does not erase the other ARM notes on the same page. For a manual ARM install, the guide says to set ARCH_SUFFIX=-arm and POSTGRES_IMAGE=chaitin/safeline-postgres-arm:15.18. It also states that SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. Verify uname -m first, then apply only those documented ARM settings. Do not point an arm64 host at the default x86 image names, and do not skip the ssse3 command just because the architecture row already matched. The table lists both checks.

Compare capacity with the published floor

The minimum environment is 1 core CPU, 1 GB of memory, and 5 GB of disk. cat /proc/cpuinfo | grep "processor" shows processor entries. free -h shows memory. df -h shows filesystem space. The manual directory step repeats that you need at least 5 GB of disk, because SafeLine writes configuration and data into the directory you create.

Accept the host only when those commands show at least one processor, at least 1 GB of memory, and at least 5 GB free on the filesystem you will use. The guide does not publish a larger production sizing table, so this check should not be padded with guessed core counts or guessed memory targets. If the host is below the floor, add capacity or pick another machine before installation. Container startup is not documented as a way to borrow the missing memory or disk.

Pass the gate, then install and proxy

After architecture, Docker, Docker Compose, CPU, memory, disk, and ssse3 are confirmed, choose one documented install path. Automatic deploy is recommended and requires root. Manual deploy ends in docker compose up -d, then the console at https://:9443/ when MGT_PORT is left at the documented default of 9443. The initial administrator account is shown by docker exec safeline-mgt resetadmin. Those later steps do not repair a failed pre-check.

Application protection is a different page. SafeLine is a web application firewall developed based on nginx. It receives traffic for the original site, removes malicious requests, and forwards the remaining traffic upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). You add an application with a domain, a listen port, and an upstream, then resolve that domain to the SafeLine server. None of that console work validates Compose 2.0.0 or the ssse3 flag. Do the host checks first, keep the command output, and only then open the installer or the compose file.

What Docker Compose version must the host show?

The deploy guide requires Docker Compose 2.0.0 or above, checked with docker compose version. Docker itself must be 20.10.14 or above, checked with docker version (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

What if lscpu prints no ssse3 flag?

CPU ssse3 is a listed dependency, and the published check is lscpu | grep ssse3. No matching line means the requirement is not confirmed. The guide does not document another command or an exception.

Does arm64 replace the ssse3 check?

No. x86_64 and arm64 are the instruction-architecture values, checked with uname -m. ssse3 is a separate CPU row. ARM also has documented image settings and a Pro license requirement, and the Personal Edition is not supported on ARM. Run both checks and then follow only the ARM notes that the deploy page actually prints.

Is 5 GB of disk optional if Compose is new enough?

No. Compose version and disk space are different rows. The minimum environment includes 5 GB of disk, and the manual install repeats that the SafeLine directory needs at least 5 GB. Use df -h on the filesystem where that directory will live.

Can the automatic installer be used to discover missing requirements?

The automatic command is the recommended install path, and it needs root, but the dependency section comes before it. Confirm Docker, Docker Compose, architecture, capacity, and ssse3 with the published commands, then run the installer or the manual docker compose up -d flow.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)