Traefik: Cloud-Native Reverse Proxy and Load Balancer

What Traefik is

Traefik (pronounced "traffic") is an MIT-licensed HTTP reverse proxy and load balancer written in Go. Its pitch, straight from the README, is that it makes deploying microservices easy by integrating with the infrastructure you already run, such as Docker, Swarm mode, Kubernetes, Consul, etcd, Rancher v2 and Amazon ECS, and configuring itself automatically from what it finds there.

The problem it targets is route maintenance. A traditional reverse proxy needs every path and subdomain mapped by hand to each backend. In an environment where services are added, removed, scaled and upgraded many times a day, keeping that mapping current becomes tedious and error-prone. Traefik instead listens to the orchestrator or service registry API and generates routes as services appear and disappear. The README puts it plainly: pointing Traefik at your orchestrator should be the only configuration step you need, although manual routes are still supported.

It is aimed at teams running containers on a single Docker host, on Kubernetes clusters, or on HashiCorp and AWS stacks, who want TLS, routing and load balancing handled at the edge without a separate config-management loop for the proxy.

How it works

Traefik's documentation splits configuration into two parts:

• Install configuration (formerly called static configuration) sets up the entrypoints Traefik listens on and the providers it connects to. It is read at startup from a file (traefik.yml, traefik.yaml or traefik.toml in /etc/traefik/, $XDG_CONFIG_HOME/, $HOME/.config/ or the working directory), from command-line arguments, or from environment variables. These three methods are mutually exclusive.
• Routing configuration (formerly dynamic configuration) defines how requests are handled: routers, middlewares, services and TLS certificates. It comes from providers and is hot-reloaded without interrupting requests or dropping connections.

Providers are the integration layer. The docs group them into label-based (Docker, Swarm, Consul Catalog, Nomad, ECS), key-value-based (Consul, etcd, Redis, ZooKeeper), annotation or resource-based (Kubernetes Ingress, IngressRoute CRD, Gateway API, and an Ingress NGINX compatibility provider), and file-based. Objects declared in one provider live in that provider's namespace and can be referenced from another with the name@provider syntax, for example a middleware defined in a file and attached to a Docker container.

The docs' FAQ is useful for understanding the request path. An entrypoint is a listener at the TCP level; routers match requests at the TLS and HTTP level and hand them to services. A request that matches no router gets a 404, a matched router with no healthy servers returns 503, and an error contacting the upstream returns 502. By default Traefik adds X-Forwarded-For, X-Real-Ip, X-Forwarded-Host, X-Forwarded-Port, X-Forwarded-Proto and X-Forwarded-Server headers when proxying.

Key features

• Continuous reconfiguration: routes update as the provider changes, with no restarts.
• Automatic HTTPS: certificates from Let's Encrypt, including wildcard certificates, and certificates can be added or removed through routing configuration without a restart.
• Load balancing and resilience: multiple load-balancing algorithms, circuit breakers and retries.
• Protocol support: WebSocket, HTTP/2 and gRPC.
• Observability: metrics for Prometheus, Datadog, StatsD and InfluxDB 2.x, plus access logs in JSON or Common Log Format, and tracing.
• Web UI and REST API: a dashboard showing routers, services and middlewares per provider, and an API exposing the same data.
• Kubernetes Gateway API and Ingress NGINX compatibility: a Gateway API provider, and a provider that translates nginx.ingress.kubernetes.io annotations so existing Ingress objects can move over unchanged.
• Single binary: shipped as one Go binary and as an official Docker image.

Getting started

The Docker quick start in the docs runs Traefik with Docker Compose, enabling the Docker provider and the dashboard on port 8080:

services:
  traefik:
    image: traefik:v3.7
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

A service is then exposed with a single label. The guide's sample app:

services:
  whoami:
    image: traefik/whoami
    labels:
      - "traefik.http.routers.whoami.rule=Host(`whoami.localhost`)"

docker-compose -f whoami.yml up -d
curl http://whoami.localhost

On Kubernetes, the documented path is the Helm chart:

helm repo add traefik https://traefik.github.io/charts
helm repo update
helm install traefik traefik/traefik -f values.yaml --wait

The chart enables the Kubernetes CRD provider by default. If you prefer a bare binary, the README points to the releases page and a sample configuration file:

./traefik --configFile=traefik.toml

Use cases

• Single-host Docker setups: put several containers behind one IP with per-hostname routing and automatic Let's Encrypt certificates, configured entirely through container labels.
• Kubernetes ingress: use IngressRoute CRDs, standard Ingress objects or Gateway API resources, with middlewares for redirects, auth and rate limiting.
• Leaving Ingress NGINX: the docs note that the Kubernetes Ingress NGINX Controller announced its retirement for March 2026, and provide a migration guide built on Traefik's annotation-translating provider.
• HashiCorp and AWS stacks: route to services registered in Consul Catalog, Nomad or ECS without maintaining a separate proxy config.
• Static backends: the file provider covers VMs and legacy services, and can be mixed with orchestrator providers.

How it compares

The obvious comparisons are other reverse proxies and ingress controllers such as NGINX, HAProxy, Caddy and Envoy-based gateways. Traefik's distinguishing choice is provider-driven configuration: routes are derived from labels, annotations or a KV store rather than from a hand-maintained config file, which suits fast-changing container environments. Teams that want a fully static, file-based proxy, or that rely on deep NGINX module ecosystems, may find a traditional proxy simpler. The Ingress NGINX migration guide lists supported annotations and behavioral differences, so check it before assuming a drop-in swap.

Things to know before adopting

• Docker socket access: the Docker provider needs the Docker API. The docs carry an explicit security note that unrestricted access is a risk, since an attacker who compromises Traefik could reach the host, and list mitigations such as a socket proxy, TLS client certificates or SSH.
• Insecure dashboard flag: --api.insecure=true in the quick start exposes the dashboard without authentication and is marked development-only.
• Support windows: from v3.6, each minor release gets six months of support, and the last minor before a new major gets two years. The docs list v3.7 (May 2026) as the actively supported line, v3.6 security support ended in August 2026, and v2.11 security support was scheduled to end in September 2026.
• Major-version migrations: the README warns to follow the migration guide when moving between majors; v1 configurations are not compatible with v2 and later.
• Experimental plugins: the plugin system for custom middlewares and providers is marked experimental and subject to change.
• Commercial layer: Traefik Labs promotes API gateway capabilities and 24/7 commercial support for the open-source proxy; the proxy itself remains MIT.

Project activity

As of October 2026 the repository has about 65,400 stars and roughly 6,300 forks. It was created in September 2015, is written in Go and is licensed under MIT. The latest release at the time of writing is v3.7.16, published on 20 October 2026, and the default branch received commits the day this was written. The README states the project usually ships three to four minor versions a year, with release candidates before each one. Source and releases are at github.com/traefik/traefik; documentation lives at doc.traefik.io/traefik and the project homepage is traefik.io.

[![Featured on TechLogHub](https://techloghub.com/badge-neutral.svg)](https://techloghub.com/open-source/traefik?utm_source=techloghub_badge&utm_medium=referral&utm_campaign=readme)