Homelab and small-prod threads keep landing on the same question:

“I want a self-hosted WAF. SafeLine/Docker, or something smaller?”

There’s no universal winner. Here’s the decision frame I use after running both styles.

Two honest shapes

A) Docker / appliance WAF