Automatic routing earns its keep when containers move
Deploy a replacement container and the proxy needs to find it before users do. Traefik watches Docker, Kubernetes, and other infrastructure providers, then updates routing as services change. That solves a recurring chore for teams whose backends move or scale during deployments. The Traefik README also lists WebSocket and gRPC support, access logs, and metrics. Automatic discovery is the reason I'd choose it.
Our checkout contained 2,345 files and about 271,814 lines of source in 32 MB. This is a substantial Go project to work on. Operators can use the published binary or official container image, so the source tree's size doesn't describe the runtime footprint. For a few fixed backends, I'd need a specific discovery problem before accepting Traefik's configuration model.
Discovery still needs routing rules and startup settings
Traefik separates startup configuration, which defines listening endpoints and provider connections, from routing configuration, which describes how requests reach services. Docker labels can supply a hostname rule beside the container definition. Routing changes reload without restarting the proxy. You still decide which applications to expose and how to secure them. The README's suggestion that pointing at an orchestrator is enough understates those decisions. The configuration introduction explains the split more clearly.
Installing the source pulled 795 packages in our sandbox. That is a contributor setup cost, not a requirement to install every package separately on a gateway host. The packaged runtime is a different route to adoption. Neither route chooses your domains, application network, or certificate policy. Review those choices alongside the service configuration.
What happened when we ran it
Our run installed Traefik in 179 seconds and built it in 326 seconds at commit 6e722fe on October 10, 2026. We used a fresh Debian container with 3 CPUs, 8 GB of RAM, and the golang:1.24-bookworm image, without elevated privileges or secrets. Both steps succeeded. Those timings describe this source checkout on this box, not the time needed to deploy a published image.
The test command failed with exit 1 after 418 seconds. The lab summary records 152 passed and 8 failed out of 160. The supplied log tail shows successful Go package results for several load balancers, TCP, TLS, types, and UDP, followed by the final FAIL. It doesn't name the failing cases or show their errors. The excerpt gives no cause. Our scan found 16 CI workflow files and a Dockerfile, but no tests directory. The passing package lines establish that checks ran despite that directory signal. Our measurement setup covers source installation, compilation, and the test command. It supplies no request-throughput or live certificate-issuance result.
Docker discovery requires access beyond an application network
The Docker provider reference warns that unrestricted Docker API access can expose the host if Traefik is compromised. Discovery requires a permitted API endpoint, and the default configuration exposes containers through Traefik unless you disable it. Set exposedByDefault=false and enable intended services explicitly. The dashboard guidance also calls for restricted, authenticated access because the API reveals configuration. A working route leaves both access decisions unresolved.
Our unprivileged container with 8 GB of RAM provides no evidence that a particular Docker access policy is sufficient. If your platform forbids the proxy from reaching Docker's API, use another provider, such as a file, or choose a proxy that fits your existing deployment process. File configuration is supported, but it gives up the automatic Docker discovery that makes Traefik attractive in the first place.
Built-in ACME leaves certificate operations to you
The ACME reference requires certificate storage and a configured domain-validation challenge. Wildcards need DNS validation and the relevant provider credentials. For highly available Kubernetes deployments, the documentation recommends a certificate controller such as cert-manager when staying with open-source Traefik. Treat issuance and renewal as a separate operational responsibility. Deploying additional proxy replicas doesn't establish that certificate challenges will reach the right instance.
The 32 MB checkout we measured is disposable. Certificate storage needs to outlive the container, so back up issuance state deliberately. Open issue 14035 requests support for supplying an existing private key to the ACME resolver and reports trouble after losing acme.json. That's a user report, separate from our run. Teams requiring a fixed, pre-audited issuance key should confirm their certificate workflow before adopting the built-in resolver.
Patch upgrades can change routing and monitoring
Release v3.7.14 shipped on October 6, 2026, with a prominent migration-guide link. Its migration instructions describe changed generated resource names and Gateway API precedence when routes match equally well. Dashboards and alerts tied to those names need attention. These are concrete upgrade costs for an operator who expects patch replacements to preserve every observed behavior.
The repository's last push was October 8, 2026. GitHub listed 65,148 stars and 950 open issues and PRs, with issue and pull-request updates continuing through October 11. That shows active maintenance, alongside a substantial queue. Our 8 failed results remain a separate finding about commit 6e722fe. Recent activity doesn't explain them, and the October 6 release isn't proof that a different deployment will pass.
Caddy is easier to justify for fixed sites
Caddy is my first comparison for fixed sites where automatic HTTPS matters more than orchestrator discovery. NGINX makes sense when serving files and keeping familiar explicit proxy configuration are priorities. Compare HAProxy when the job centers on deliberately configured load balancing. Traefik earns the extra attention when deployment metadata should drive routes.
Before switching real traffic, require the deployment to demonstrate backend replacement and certificate recovery. Our 152 passing results don't answer either question. Verify that the intended hostname reaches the replacement service, an unapproved container stays unreachable, and certificate state survives recreation. Keep your existing gateway until that replacement and recovery drill passes.