diff --git a/Dockerfile b/Dockerfile
index 13ebb9e39..7f327b870 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,7 @@ ENV DISABLE_ONLINE_API=false
 ENV DSN=
 ENV TYPE=
 ENV TEST_MODE=false
+ENV USE_WAL=false
 
 # register to app.crowdsec.net
 
diff --git a/Dockerfile.debian b/Dockerfile.debian
index b722b27a8..4ea120e3a 100644
--- a/Dockerfile.debian
+++ b/Dockerfile.debian
@@ -52,6 +52,7 @@ ENV DISABLE_ONLINE_API=false
 ENV DSN=
 ENV TYPE=
 ENV TEST_MODE=false
+ENV USE_WAL=false
 
 # register to app.crowdsec.net
 
diff --git a/docker/README.md b/docker/README.md
index a4e0ca38b..fd1bf709a 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -198,6 +198,7 @@ Using binds rather than named volumes ([complete explanation here](https://docs.
 | `PLUGIN_DIR`            | `/usr/local/lib/crowdsec/plugins/` | Directory for plugins: `-e PLUGIN_DIR="<path>"` |
 | `BOUNCER_KEY_<name>`    | | Register a bouncer with the name `<name>` and a key equal to the value of the environment variable. |
 | `METRICS_PORT`          | 6060 | Port to expose Prometheus metrics |
+| `USE_WAL`               | false | Enable Write-Ahead Logging with SQLite |
 |                         | | |
 | __Console__             | | |
 | `ENROLL_KEY`            | | Enroll key retrieved from [the console](https://app.crowdsec.net/) to enroll the instance. |
diff --git a/docker/docker_start.sh b/docker/docker_start.sh
index 4b7c07788..8aae9d553 100755
--- a/docker/docker_start.sh
+++ b/docker/docker_start.sh
@@ -77,6 +77,13 @@ if [ ! -e "/etc/crowdsec/local_api_credentials.yaml" ] && [ ! -e "/etc/crowdsec/
     fi
 fi
 
+# do this as soon as we have a config.yaml, to avoid useless warnings
+if istrue "$USE_WAL"; then
+    conf_set '.db_config.use_wal = true'
+elif [ -n "$USE_WAL" ] && isfalse "$USE_WAL"; then
+    conf_set '.db_config.use_wal = false'
+fi
+
 # regenerate local agent credentials (ignore if agent is disabled)
 if isfalse "$DISABLE_AGENT"; then
     if isfalse "$DISABLE_LOCAL_API"; then