Traefik can discover Docker containers automatically, create routes from container labels, terminate HTTPS, and forward requests to the correct service without manually editing a proxy configuration. The reliable pattern is to run Traefik on a shared Docker network, publish ports 80 and 443, disable automatic exposure, and opt each application in with explicit labels.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What Traefik does in a Docker deployment
Traefik sits at the edge of your Docker host. A client requests a hostname such as app.example.com; Traefik matches that hostname against a router, optionally completes TLS negotiation, and forwards the request to the container and port defined by the generated service.
As an Amazon Associate I earn from qualifying purchases.
The Docker provider watches Docker events and reads labels from containers. Starting, stopping, or recreating a Compose service can therefore update Traefik’s dynamic configuration without editing a separate proxy file. The labels describe the public rule, entrypoint, TLS behavior, and backend port.
This automation is useful only when the surrounding prerequisites are correct: DNS must point to the host, ports must be reachable, Traefik and the application must share a network, and the router must match the request’s Host header.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Architecture and prerequisites
Components you need
- A Docker Engine host running Traefik and the applications it will proxy.
- A DNS record for every public hostname, pointing to the host’s reachable address.
- A dedicated Docker network shared by Traefik and each routed application.
- Host firewall or cloud security-group rules allowing TCP 80 and 443.
- A persistent, writable location for ACME certificate data if you enable Let’s Encrypt.
- Traefik configuration that uses the Docker provider and, preferably,
exposedByDefault=false.
Standalone Docker versus Swarm
For ordinary Docker Engine and Compose deployments, labels belong directly under a service’s labels key. Docker Swarm uses service labels under deploy.labels instead. The provider and routing concepts are the same, but placing labels at the wrong level means Traefik will not create the expected router.
| Decision | Docker Engine/Compose | Docker Swarm |
|---|---|---|
| Where routing labels go | Service-level labels |
deploy.labels |
| Backend discovery | Container events and metadata | Swarm service metadata |
| Network requirement | Shared user-defined network | Shared overlay network |
| Best fit for this guide | Compose on one Docker host | Use the same principles with Swarm-specific label placement |
Create the network and Traefik service
Use a dedicated network
Create an external network once if several Compose projects will share it:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalldocker network create proxyIf Traefik and all applications are in one Compose project, you can let Compose create the network instead. A shared, dedicated network makes the intended path explicit and avoids accidentally routing over an unrelated application network.
Compose example for Traefik v3.7
The following example uses the Traefik v3.7 image, publishes ports 80 and 443, mounts the Docker socket read-only, enables the Docker provider, and configures a TLS-ALPN ACME resolver. Replace the example email and hostnames with your own values.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
services:
traefik:
image: traefik:v3.7
command:
- --api.dashboard=true
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --providers.docker.network=proxy
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- [email protected]
- --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.myresolver.acme.tlschallenge=true
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
networks:
- proxy
networks:
proxy:
external: trueBefore starting, create the storage file and restrict its permissions:
mkdir -p letsencrypt
touch letsencrypt/acme.json
chmod 600 letsencrypt/acme.jsonTraefik must be able to write this file, and the directory must survive container recreation. If the file is stored only inside the container, certificates and account data disappear when that container is removed.
Why each setting matters
--providers.docker=trueenables Docker event and label discovery.--providers.docker.exposedbydefault=falseprevents every container from becoming reachable automatically.--providers.docker.network=proxytells Traefik which shared network to use when a container is attached to multiple networks.- The
webandwebsecureentrypoints bind Traefik to ports 80 and 443 inside the container; theportssection publishes those ports on the host. - The read-only socket mount allows metadata and event access without giving the Traefik container write access to the Docker socket.
- The ACME storage path must match the mounted persistent directory.
Route a Compose application by hostname
Add the application to the same network
Here is a minimal application service. The image and internal port are examples; use the port on which your application actually listens inside the container.
services:
app:
image: your-image:tag
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.app.rule=Host(`app.example.com`)
- traefik.http.routers.app.entrypoints=websecure
- traefik.http.routers.app.tls.certresolver=myresolver
- traefik.http.services.app.loadbalancer.server.port=8080
networks:
proxy:
external: trueThe router name (app) and service name used in the labels are arbitrary identifiers. Keep them consistent within that service so the router points to the intended load balancer.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Understand the labels
| Label | Purpose |
|---|---|
traefik.enable=true |
Opts this container into discovery when automatic exposure is disabled. |
traefik.http.routers.app.rule=Host(`app.example.com`) |
Creates an HTTP router that matches requests with this hostname. |
traefik.http.routers.app.entrypoints=websecure |
Accepts the route on the HTTPS entrypoint. |
traefik.http.routers.app.tls.certresolver=myresolver |
Requests and renews a certificate through the named ACME resolver. |
traefik.http.services.app.loadbalancer.server.port=8080 |
Forwards traffic to port 8080 inside the container. |
When the backend port must be explicit
Traefik can often infer a container’s exposed port, but inference becomes ambiguous when an image exposes multiple ports or does not describe the listening port in a way Docker reports. Set traefik.http.services.<service>.loadbalancer.server.port explicitly whenever there is more than one candidate or whenever the generated service points at the wrong port. The value is the container’s internal listening port, not necessarily the host-published port.
Start and inspect the stack
- Confirm the DNS record for
app.example.comresolves to the Docker host. - Start or update the stack with
docker compose up -d. - Check container state with
docker compose ps. - Read Traefik’s startup and provider messages with
docker compose logs traefik. - Open the hostname after DNS and certificate issuance have completed.
Configure HTTPS with ACME
Choose a challenge supported by your deployment
Traefik’s ACME integration documents HTTP-01 and TLS-ALPN-01 challenges. The Compose configuration above uses TLS-ALPN-01, which requires the hostname to reach Traefik on port 443 during validation. HTTP-01 validates over port 80, so that port must be publicly reachable and routed to the ACME challenge handler.
| Challenge | What must reach Traefik | Typical constraint |
|---|---|---|
| HTTP-01 | HTTP requests on port 80 | Port 80 cannot be blocked or diverted before Traefik receives the challenge. |
| TLS-ALPN-01 | TLS validation on port 443 | Port 443 must be reachable directly by the certificate authority. |
Certificate resolver requirements
- Give the resolver a stable name, such as
myresolver, and use exactly that name in the router’stls.certresolverlabel. - Set an email address for ACME account notices.
- Point
acme.storageto a persistent file mounted into the container. - Ensure Traefik can write the file and that its permissions are restricted.
- Publish the entrypoint required by the selected challenge and allow it through upstream firewalls.
Certificate issuance is tied to the hostname in the router rule. A typo in the DNS record, hostname, resolver name, or entrypoint can prevent issuance even though the containers themselves are healthy.
Optional HTTP-to-HTTPS redirect
A route that listens only on websecure does not automatically redirect plain HTTP. If you want visitors who type an http:// URL to move to HTTPS, create a second router on web and attach a redirect-scheme middleware. Keep the HTTPS router on websecure with its TLS resolver; the HTTP router’s job is only to issue the redirect.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Secure the Docker API and dashboard
Treat the Docker socket as a control boundary
Traefik needs Docker API information to discover containers, but access to that API is highly sensitive. Use a read-only socket mount where your deployment permits it, restrict who can reach the Traefik container, and avoid exposing the Docker API itself to the public network. A compromised proxy with broad Docker access could potentially affect the host and other containers.
If your security design cannot allow a direct socket mount, use a restricted Docker API proxy that exposes only the read operations Traefik requires. Validate the proxy’s permissions and failure behavior before relying on it in production.
Free tools Windows power users keep installed
One-click scans. No signup required.
Protect the dashboard
Enable the dashboard only when you need it. Do not publish Traefik’s API with an unauthenticated insecure endpoint. If you route the dashboard through Traefik, expose the internal service endpoint through a hostname protected by authentication and, where practical, an IP allow-list or private network. Keep passwords and tokens out of labels; use Docker secrets or mounted files for credentials instead.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose 404, 502, and certificate failures
Work from the outside in. Checking the backend first can waste time when DNS or the router is the real problem.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Verify DNS. Resolve the requested hostname from a client and confirm it points to the host that runs Traefik. Check both IPv4 and IPv6 records if both are published.
- Verify reachability. Confirm that host ports 80 and 443 are published by the Traefik container and allowed by the host firewall, cloud firewall, and any upstream router.
- Verify network membership. Run
docker network inspect proxyand confirm both Traefik and the application are attached to the intended network. - Verify the Host rule. The requested hostname must exactly match the value in
Host(`...`). Requests made directly to an IP address will not match a hostname-only rule. - Verify entrypoints and TLS. A router listening on
websecurewill not answer onweb. Confirm the router’s entrypoint, TLS flag, and certificate resolver name. - Verify the backend port. Check the application’s listening port from inside its container and set the load-balancer port label explicitly when detection is uncertain.
- Inspect generated configuration. Review Traefik logs and the dashboard, if securely enabled, for the expected router, service, rule, entrypoint, and server URL.
A 404 response
A Traefik-generated 404 usually means no router matched the request. Check the hostname, entrypoint, whether the container has traefik.enable=true, and whether the labels are attached at the correct level for Docker Engine or Swarm. Also check that the request reached the correct Traefik instance rather than another server returned by DNS.
A 502 response
A 502 generally means a router matched but Traefik could not successfully connect to the backend. Confirm that the application is running, both containers share a network, the selected network is the one Traefik uses, and the internal port label matches the process’s listening port. A host-published port is not required for container-to-container traffic on the shared network.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →ACME issuance or renewal errors
Check that the hostname resolves publicly, the selected challenge’s port reaches Traefik, the resolver name matches the router label, and acme.json is persistent and writable. Read the ACME error in Traefik’s logs; repeated failed attempts can also trigger certificate-authority rate limits, so correct DNS and reachability before retrying.
Operational practices that prevent common failures
- Pin a deliberate Traefik major and minor image version, then review the current reference before changing versions because syntax and defaults can change.
- Keep routing labels close to the application definition so recreating the service preserves its route.
- Use one clearly named proxy network and declare it consistently across Compose projects.
- Leave automatic exposure disabled and opt services in individually.
- Store ACME data outside the container and back up it according to your security policy.
- Keep secrets, passwords, and private keys out of labels, which are visible through Docker metadata.
- Test a new hostname with a temporary low-risk service before moving a critical application behind it.
- When changing labels, recreate the service so Docker emits the event Traefik needs to rebuild its dynamic configuration.
Choosing between common deployment options
| Choice | Advantages | Trade-offs |
|---|---|---|
| Automatic backend port detection | Fewer labels for simple, single-port images. | Ambiguous images can produce the wrong target; behavior depends on image metadata. |
| Explicit backend port label | Deterministic routing and easier troubleshooting. | Must be updated if the application changes its internal port. |
| HTTP entrypoint only | Simple for private networks or temporary testing. | No transport encryption for public traffic. |
| HTTPS with ACME | Automated certificate issuance and renewal through a resolver. | Requires public DNS, reachable challenge ports, persistent storage, and correct time/network operation. |
| Direct read-only Docker socket | Simple and supported discovery path. | The socket remains a powerful host boundary even when mounted read-only. |
| Restricted Docker API proxy | Reduces the API surface Traefik can access. | Adds another component that must be configured, secured, and monitored. |
What a correct request path looks like
- The client resolves
app.example.comto the Docker host. - The connection arrives at host port 443 and is published to Traefik’s
websecureentrypoint. - Traefik matches the request’s Host header to the router rule generated from the application’s labels.
- The configured ACME certificate resolver supplies the certificate for the hostname, or Traefik serves an existing certificate from persistent storage.
- Traefik selects the Docker network and forwards the request to the application’s internal port.
- The application response travels back through Traefik to the client.
If any step fails, use that sequence to choose the next check: DNS and firewall first, then entrypoint and router matching, then network and backend connectivity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
