DEV Community

Lia
Lia

Posted on

SafeLine WAF Docker Setup: Complete Beginner's Guide

#webdev #tutorial #devops #security

You don't need to be a security engineer to deploy a WAF. If you can run docker compose up, you can have SafeLine protecting your applications in under 15 minutes.

What You'll Need

  • A Linux server (Ubuntu 20.04+, Debian 11+, CentOS 7+)
  • Docker 20.10.6+ and Docker Compose 2.0.0+
  • 1 CPU core, 1 GB RAM, 5 GB free disk space
  • A domain or public IP pointing to your server

Step 1: Install Docker

If Docker isn't already installed:

curl -fsSL https://get.docker.com | bash
Enter fullscreen mode Exit fullscreen mode

Verify:

docker --version
docker compose version
Enter fullscreen mode Exit fullscreen mode

Step 2: Install SafeLine 

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

This single command handles everything — pulls the Docker images, creates the containers, sets up the network, configures PostgreSQL, and starts all services. It takes 2-3 minutes.

The containers that get created:

  • Tengine — the reverse proxy (Nginx fork) that handles incoming traffic
  • Detector — the semantic analysis engine that inspects requests
  • PostgreSQL — stores configuration and attack logs
  • Management — the web dashboard

Step 3: Access the Dashboard

Open https://<your-server-ip>:9443 in your browser. The first time, you'll be prompted to set up TOTP authentication — scan the QR code with any authenticator app.

Step 4: Add Your First Site

  1. In the dashboard, go to Sites -> Add Site
  2. Enter your domain name
  3. Set the backend address (e.g., localhost:3000 if your app runs on the same server)
  4. Choose the port — SafeLine defaults to 80/443, or set a custom port if you're chaining it behind another proxy

Protection starts immediately. No rule configuration required.

Step 5: Configure DNS

Point your domain's A record to your server's IP. Traffic flows through SafeLine and gets inspected before reaching your app.

Step 6: Verify Protection

Test with a simple SQL injection attempt:

curl "http://yourdomain.com/?id=1' OR '1'='1"
Enter fullscreen mode Exit fullscreen mode

Open the SafeLine dashboard -> Attack Logs. You should see the blocked request.

Step 7: Basic Configuration

What to set up on day one:

  1. Rate limiting — Set per-IP request limits under Rules
  2. Geo-blocking — Block countries you don't serve under IP Groups
  3. Bot protection — Enable under Bot Management for login pages and forms
  4. SSL — Upload your certificate or enable Let's Encrypt auto-renewal

Keeping It Updated 

docker compose -f /path/to/safeline/docker-compose.yml pull
docker compose -f /path/to/safeline/docker-compose.yml up -d
Enter fullscreen mode Exit fullscreen mode

SafeLine releases updates every 2-3 weeks. Run these commands to stay current.

FAQ

Do I need to change my existing Nginx config?

If SafeLine is your primary reverse proxy — point Nginx to an internal port and let SafeLine handle 80/443. If you want Nginx in front — set SafeLine to a custom port and proxy to it.

Can I run it on a Raspberry Pi?

Yes, if it runs Docker. Resource requirements are low: a Pi 4 with 4 GB RAM easily handles SafeLine plus a few lightweight apps.

Will it conflict with Certbot or Let's Encrypt?

SafeLine and an external reverse proxy can both manage SSL. Just make sure only one service handles TLS per domain.

What if I break something?

Stop SafeLine (docker compose down), and traffic bypasses the WAF. Your app stays online. Fix the config, restart.

Related reads:

What's the first app you'd put behind SafeLine?

Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn

Top comments (0)