Reverse proxy for containers
auto-discover Docker / Kubernetes services
// official site: traefik.io ↗
DEVOPS · FREE TIER
Traefikfree
Traefik is a modern reverse proxy + load balancer with native Docker / Kubernetes service discovery. Configuration via container labels (no nginx config files), automatic Let's Encrypt SSL, dynamic load balancing. Designed for container-first environments where services start / stop dynamically.
// What it is
A closer look.
Traefik is a modern reverse proxy + load balancer with native Docker / Kubernetes service discovery. Configuration via container labels (no nginx config files), automatic Let's Encrypt SSL, dynamic load balancing. Designed for container-first environments where services start / stop dynamically.
For Docker / Kubernetes operators who want their reverse proxy to discover services automatically, Traefik is the canonical choice.
// Use cases
What it's for.
Concrete scenarios where teams pick Traefik over the SaaS alternative.
Automatic SSL
Let's Encrypt via labels, no manual cert ops
Load balancing
round-robin / weighted / sticky session
HTTP / TCP / UDP proxy
beyond HTTP for databases, MQTT, etc.
Middleware pipeline
rate limiting, auth, headers manipulation
// Who it's for
Built for these teams.
If your team profile matches one of these, Traefik is a strong fit out of the box.
Docker users
wanting reverse proxy with auto-discovery
Kubernetes operators
preferring Traefik to nginx-ingress
DevOps teams
managing dynamic container fleets
Multi-tenant hosts
routing many subdomains via labels
Hosting providers
with container-based customer workloads
// Differentiators
Why teams pick Traefik.
When evaluating self-hosted options for this category, here are the dimensions on which Traefik consistently lands above the alternatives.
- ✓MIT license — fully open
- ✓Container-native — labels are config; no separate file
- ✓Auto Let's Encrypt — like Caddy but more sophisticated
- ✓Middleware — rate limit / auth / redirect / strip via composable rules
- ✓HTTP/3 support — QUIC protocol
- ✓Dashboard — visual view of routes and services
// Integrations
Connects to.
The stack you'll plug Traefik into — services, protocols, and adjacent apps in the BluixApps catalog.
◇
Service discovery
Docker, Kubernetes, Consul, Nomad, ECS, file-based
◈
ACME
Let's Encrypt, ZeroSSL, custom CA
◆
DNS-01
70+ DNS providers for wildcard certs
▣
Middleware
basic auth, JWT, rate limit, IP allow, headers, redirect
▦
Observability
Prometheus metrics, OpenTelemetry tracing, JSON logs
▩
Plugins
Yaegi plugin system for custom Go middleware
▼
Authentication
built-in basic / forwardauth (Authelia, Authentik)
// Adoption & deployment
Notable users & community
- 51k+ GitHub stars
- Used by Conde Nast, Bose, Deutsche Bahn for production routing
- Backed by Traefik Labs with sustainable commercial enterprise
- Standard ingress controller alongside nginx-ingress in K8s ecosystem
- Active community, frequent releases
What we ship
- Docker compose: Traefik + persistent ACME storage
- Pinned
traefik:v3.2(release-tagged) - Automatic Docker discovery enabled
- Dashboard exposed on alternate port, basic auth protected
- Let's Encrypt config for HTTP-01 (DNS-01 optional)
- Persistent volume for ACME certs
- Backup hook covers ACME storage + Traefik config
// Tips & operations
Run it properly.
Operational guidance from running this in production — what to lock down, what surprises people.
// PERFORMANCE
Labels strategy
define naming conventions early; labels become unreadable fast
// SECURITY
DNS-01 for wildcards
HTTP-01 doesn't do wildcards
// OPERATIONS
Persistent ACME storage
mount volume so certs survive restarts
// RELIABILITY
Dashboard auth required
admin dashboard exposes routes; protect with basic auth
// DEPLOYMENT
Middleware order matters
pipeline order affects behavior
// SCALING
Monitor cert renewals
set up alerts on renewal failures
256
// min ram (MB)
2
// min disk (GB)
8080
// access port
http
// protocol
free
// bluixapps tier
// Alternatives in DevOps
Compare with
Project resources
Official sitetraefik.io ↗