DEV Community

Lia
Lia

Posted on

SafeLine WAF Docker Compose Example

#webdev #security #tutorial #docker

SafeLine WAF Docker Compose Example

SafeLine ships as a set of containers, and Docker Compose is the simplest way to bring up the whole stack — management console, detection engine, and the supporting database and cache — on a single host.

The fastest path

The official one-line installer handles the compose file for you:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

It writes a docker-compose.yml in the SafeLine directory and starts the services. After it finishes, open the console at https://<host-ip>:9443 to add your protected sites.

What the stack contains

A typical SafeLine compose defines a few services working together:

  • Management console — the web UI on :9443 where you configure sites and view logs.
  • Detection engine / proxy — the component that actually inspects and forwards traffic on :80 / :443.
  • Database — stores configuration and records.
  • Cache — used for session and challenge state.

An illustrative compose looks like:

services:
  safeline-mgt:            # management console
    image: chaitin/safeline-mgt:latest
    ports: ["9443:9443"]
  safeline-detector:       # inspection + reverse proxy
    image: chaitin/safeline-detector:latest
    ports: ["80:80", "443:443"]
  safeline-pg:             # database
    image: chaitin/safeline-pg:latest
  safeline-redis:          # cache
    image: chaitin/safeline-redis:latest
Enter fullscreen mode Exit fullscreen mode

Treat the exact image names, tags, and ports above as illustrative — pull the authoritative docker-compose.yml from the official installer or docs, since these can change between versions.

Customizing

Once it's up, common tweaks:

  • Persist data — add named volumes for the database and config so they survive container recreation.
  • Change ports — if :80/:443 are taken, map the proxy to different host ports and adjust your upstream/DNS accordingly.
  • Protect a site — in the console, add a site whose upstream is your app (e.g. http://127.0.0.1:8080).

FAQ

Do I need to write the compose myself?

No — the installer generates it. Hand-writing is only if you want a custom layout.

Can I run it alongside other compose stacks?

Yes; just keep the ports and volume names from colliding with other services.

Free tier?

The Community Edition covers 10 apps at 800 QPS for free.

That's it — a single compose stack gives you a running self-hosted WAF.

Top comments (0)