Traefik turns service discovery into live routes
Traefik sits between clients and services, then builds routing configuration from infrastructure state. A Docker container can declare a host rule in labels. Kubernetes users can work through Ingress, custom resources, or Gateway API. File configuration remains available when a route should be explicit. This is useful in clusters where instances scale and move often enough that maintaining upstream addresses by hand becomes a source of outages.
The proxy handles HTTP, TCP, and UDP traffic. Its documented features include several load-balancing algorithms, Let's Encrypt certificates, retries, circuit breakers, WebSockets, HTTP/2, gRPC, access logs, metrics, an API, and a dashboard. Those parts put routing, certificate state, provider access, and observability in one process. Treat Traefik as infrastructure.
The five-minute Docker demo is deliberately insecure
The Docker quick start exposes ports 80 and 8080, mounts /var/run/docker.sock, and sets api.insecure=true. The guide calls that dashboard mode development-only and says not to enable it in production. It is a fair demonstration because a reader can route a whoami container with one label. It is a bad deployment template because anyone reaching port 8080 gets the API and dashboard without authentication.
Production needs a router for api@internal, plus authentication or an IP allowlist. The Docker socket is another trust decision: a process that can talk to the daemon has powerful access to container metadata and operations. A socket proxy or a constrained remote endpoint can reduce direct exposure, but the operator must still protect those credentials and network paths. Dynamic discovery works because Traefik can see the control plane.
What happened when we ran it
Our sandbox installed 956 Go packages in 148 seconds at commit 9bb0e55. The 31.3 MB checkout contained 2,275 files and about 253,191 source lines. Building succeeded in 311 seconds. This is slower than the quick-start experience with a published binary or image, but it proves that the measured source revision compiled in the stated 3-CPU, 8 GB Debian environment.
Tests ran for 597 seconds and exited with code 1. The Go summary counted 47 passed groups and 3 failed out of 50. The supplied tail shows successful packages such as TLS and UDP, several directories with no test files, and then only FAIL. It does not identify the three failed groups or their errors, so blaming network access, timing, privileges, or missing services would be guesswork.
Our checkout scan found 14 CI workflow files, a Dockerfile, and no top-level tests directory. Go projects commonly keep tests beside packages, and the command did find 50 test groups, so the directory signal is only structural. No dependency vulnerability count came with this lab block. The useful acceptance result is narrower: installation and build passed, while the complete invoked test command did not.
Docker discovery exposes services unless you opt out
The Docker provider watches events by default and reads labels to build routes. Its exposedByDefault option also defaults to true. Teams that want explicit publication should set it false, then require traefik.enable=true on every intended service. That reduces the chance that a newly launched internal container inherits a default route because someone forgot a negative label.
Network selection matters too. Traefik normally connects to a container's internal network address, while labels can name a service port or network. Multi-network Compose stacks can produce surprising targets if the default network is not stated. Test each route from outside the host, check which backend address Traefik selected, and watch the dashboard or API for configuration errors without exposing either interface publicly.
Static and dynamic configuration fail in different ways
Entry points, providers, logging, metrics, API settings, and certificate resolvers belong to installation configuration. Routers, middlewares, services, and TLS routing choices are dynamic configuration. Mixing those layers in one mental model causes frustrating restarts and ignored settings. A changed label can update a router live; a changed entry-point address usually belongs to startup configuration and requires a process restart.
Certificate automation also needs persistent storage and correct DNS or HTTP challenge reachability. Losing ACME state can trigger unnecessary issuance attempts or rate limits. Back up the certificate store with the rest of the gateway state, lock down its file permissions, and test renewal before the first expiry window. For replicas, follow the documented design instead of letting several instances write one local certificate file.
Gateway security depends on exact trust boundaries
Traefik's security documentation treats path normalization, forwarded headers, TLS selection, cross-namespace references, and generated identifiers as distinct boundaries. That is the right level of concern for a public gateway. An operator must decide which proxy IPs may supply forwarding headers, which Kubernetes namespaces may reference others, and where authentication is enforced before traffic reaches an application. Defaults cannot know the organization's topology.
Release v3.7.12 arrived on August 26, 2026 with fixes for HTTP/3 timeouts, header handling, ingress-nginx namespace naming, Docker image components, and negative TCP or UDP weights. It also added published security-decision documentation. None of that means the release is unsafe. It means a gateway upgrade deserves release-note review and a staging route test because protocol and provider fixes can change edge behavior.
Current activity is high, and the support queue is large
GitHub listed 64,609 stars, 909 combined issues and pull requests, and a last push on August 26, 2026. The latest release was published the same day. That combination shows active development and issue handling; the combined count should not be described as 909 bugs. It also means users can find a lot of historical advice that targets Traefik v2 or an earlier v3 minor.
Pin documentation to the deployed version and read each migration guide. Traefik earns its place when route discovery removes repeated manual work across many services. The 311-second source build passed, but our 597-second test run did not, so validate the exact release and provider mix you plan to expose. For two stable backends, explicit configuration is simpler.