Coder Legion - Recent posts tagged compose

Why I Verify Docker Compose and SSSE3 Before a WAF Install

Thu, 29 Oct 2026 04:26:25 +0000

Before I install a web application firewall, I verify the host against the published dependency table. For SafeLine, that table is not a suggestion buried under a feature list. The deploy guide states Linux, instruction architectures x86_64 and arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, a minimum of 1 CPU core, 1 GB of memory, 5 GB of disk, and CPU ssse3. It also prints the commands that confirm those facts. I care about Docker Compose and SSSE3 in particular because operators often prove only that the docker command exists, then treat the rest as implied. It is not implied.

SafeLine, as described in the product introduction, is a self-hosted WAF placed in front of a web application. It filters and monitors HTTP traffic and works as a reverse proxy so clients reach the WAF before the origin. That role does not relax the host requirements. A reverse proxy still has to start on a machine that meets the install contract. The introduction page points installation questions to the install guide, and the install guide is where the version and instruction checks live: https://docs.waf.chaitin.com/en/GetStarted/Deploy

I split the preflight into gates that match the command list, not into a single glance that Docker looks fine.

Architecture comes first. uname -m is the documented way to view the instruction architecture. I am looking for x86_64 or arm64, because those are the two values in the dependency table. A different machine type is a stop, even if Docker happens to be installed.

The engine and Compose are next, and they are not the same check. docker version is how the guide says to view the Docker version. I need 20.10.14 or above. docker compose version is how the guide says to view the Docker Compose version. I need 2.0.0 or above. I type Compose as a subcommand, because that is the command printed in the guide. A successful engine report does not contain the Compose version. If Compose is missing, or the version is below 2.0.0, I do not continue to the installer and I do not run a compose file just to see. The manual launch step is docker compose up -d, which assumes this dependency is already satisfied.

SSSE3 is a processor flag, checked with lscpu | grep ssse3. I want the command to print a line that includes ssse3. If it prints nothing, the flag was not found in that output, and I record a failed check. I do not reinterpret silence as probably fine on a modern CPU. The table lists CPU ssse3 on its own row. uname -m does not answer that row. Processor count does not answer it either. cat /proc/cpuinfo | grep "processor" is only the documented view of CPU info for the one-core minimum.

Memory and disk stay on the same sheet. free -h is the memory check against the 1 GB minimum. df -h is the disk check against the 5 GB minimum. The guide repeats the disk point when it tells you to create a directory: SafeLine writes configuration and data there, and you need at least 5 GB of disk space. In the manual layout that directory is /data/safeline. Checking free space on a different filesystem, then installing onto a small one, does not meet the written requirement.

ARM needs an extra documented note that is easy to mix up with the ssse3 line. The manual deploy section says SafeLine installed on ARM requires a Pro license to work properly, and that the Personal Edition is not supported on ARM. It also says to set ARCH_SUFFIX=-arm and to use the ARM Postgres image named in the guide. Those are edition and image settings. They are not a substitute for the ssse3 command, and the ssse3 command is not a license check. I write three separate results: architecture, whether lscpu showed ssse3, and whether the edition constraint for ARM applies to this host.

Only a full pass moves me to deploy. The recommended path in the guide is the automatic installer, which requires root and is the manager.sh command with --en. Manual deploy is the other documented path: install Docker if it is not already present, create /data/safeline, download compose.yaml, write .env, generate the tokens the guide shows, fix permissions, link the socket path, then start the stack. I do not invent a third path when a check fails. The guide's uninstall steps, docker compose down and removal of the SafeLine directory, are for a host you intend to clear, not a way to probe a machine that missed the dependency table.

Host verification is also not the same as proving the WAF is protecting an application. After a successful start, the deploy guide says to open the web console at https://<safeline-ip>:9443/ and to obtain the initial admin account with docker exec safeline-mgt resetadmin. Adding an application is a later configuration step: the console asks for domain, listen port, and upstream. The application document says SafeLine acts as an HTTP or HTTPS reverse proxy, receives traffic for the original website, cleans malicious attack traffic, and forwards the safe and reliable traffic to the original application. Those steps assume the instance is already running on a host that met the install dependencies. I cite that behavior from the official pages rather than from habit: the product overview is at https://docs.waf.chaitin.com/en/home, the dependency and command list is at https://docs.waf.chaitin.com/en/GetStarted/Deploy, and the proxy settings are at https://docs.waf.chaitin.com/en/GetStarted/AddApplication.

Does docker version replace docker compose version?

No. The deploy guide lists Docker 20.10.14 or above and Docker Compose 2.0.0 or above as separate software dependencies, and it tells you to run both docker version and docker compose version. One report does not satisfy the other row.

What if lscpu | grep ssse3 prints nothing?

That command is the published check for the CPU ssse3 instruction. No output means the flag did not appear in lscpu text on this host. I mark the dependency unmet and I do not start installation to discover a workaround. The guide does not document a bypass for a missing ssse3 flag.

Is x86_64 or arm64 enough by itself?

No. Those values satisfy the instruction architecture row only. CPU ssse3 is a separate dependency with its own command. On ARM, the same deploy guide adds a license constraint: a Pro license is required, and the Personal Edition is not supported. I do not collapse architecture, instruction flag, and edition into one result.

Which memory and disk numbers are in the contract?

The minimum environment is 1 core CPU, 1 GB memory, and 5 GB disk. free -h and df -h are the commands the guide prints for memory and disk. The directory instructions repeat that at least 5 GB must be available where SafeLine will store configuration and data.

Should the installer run before these commands pass?

No. The guide places the confirmation commands before the automatic installer and before the manual docker compose up -d step. I use them as entry conditions. A later console login check cannot repair a host that never met Docker Compose 2.0.0 or the ssse3 line.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

How to Verify Docker Compose and SSSE3 Requirements for SafeLine WAF

Thu, 29 Oct 2026 04:25:53 +0000

SafeLine is a self-hosted web application firewall that filters and monitors HTTP traffic between a web application and the Internet, and it works as a reverse proxy that cleans malicious traffic before it reaches the origin server (https://docs.waf.chaitin.com/en/home). Because it runs as a set of containers managed by Docker Compose, the deployment guide asks you to confirm a short list of prerequisites before installing (https://docs.waf.chaitin.com/en/GetStarted/Deploy). The official minimums are a Linux host, x86_64 or arm64 architecture, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, 1 CPU core, 1 GB memory, 5 GB disk, and CPU support for the ssse3 instruction set. The commands below turn that checklist into a repeatable preflight routine, so you can spot a missing dependency before the installer runs.

Why does the guide require Docker Compose 2.0.0 or above?

SafeLine is deployed from a compose.yaml file with docker compose up -d. The modern docker compose plugin syntax requires Docker Compose 2.0.0 or above, and the older docker-compose binary with a hyphen does not satisfy that requirement (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Verify both tools in one step:

docker version
docker compose version

Look for the Docker Engine at 20.10.14 or newer and the Compose plugin at 2.0.0 or newer. If docker compose version returns an error, the Compose plugin is missing or only the legacy binary is installed, and that should be fixed before continuing.

What does the ssse3 CPU requirement actually mean?

ssse3, or Supplemental Streaming SIMD Extensions 3, is an x86 instruction set extension. The SafeLine deployment prerequisites list CPU ssse3 as a requirement (https://docs.waf.chaitin.com/en/GetStarted/Deploy). In practice this means the detection components expect the host CPU to expose that instruction set, so a very old or unusual x86 processor that lacks ssse3 can fail even when Docker and Compose are otherwise fine. Check it directly with:

lscpu | grep ssse3

If the command prints a line that lists ssse3 among the supported flags, the CPU is acceptable. No output usually means the flag is absent. On arm64 hosts this x86-specific check does not apply the same way, but the guide still lists arm64 as a supported instruction architecture alongside x86_64 (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Which commands confirm the CPU, memory, and disk minimums?

The documentation groups the checks into a small command set (https://docs.waf.chaitin.com/en/GetStarted/Deploy):

uname -m reports the instruction architecture.
cat /proc/cpuinfo | grep "processor" lists the logical processors so you can confirm at least one core.
free -h shows total and available memory so you can confirm at least 1 GB.
df -h shows free disk space so you can confirm at least 5 GB in the directory where SafeLine will write its data.

Run these on the intended host rather than on a jump box or a different machine. The disk check matters because SafeLine writes configuration and data to a directory such as /data/safeline, and the guide asks for at least 5 GB there (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

What is the cleanest pre-install order to follow?

Verify in this order: operating system, architecture, ssse3, Docker, Compose, then capacity. That sequence catches the least fixable problems first. If the CPU lacks ssse3, installing newer Docker versions will not help, so it is better to learn that before downloading anything. If Docker is too old, upgrade it before the installer attempts to manage containers. Confirm the host with uname -m, check lscpu | grep ssse3, then run docker version and docker compose version, and finish with free -h and df -h. After all checks pass, the automated installer or the manual compose steps from the guide can proceed, ending with docker compose up -d and access to the web console on port 9443 by default (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto