Traefik: a reverse proxy that configures itself from Docker and Kubernetes

traefik/traefik (about 65,000 stars) is a reverse proxy and load balancer built for container platforms. Instead of a configuration file that lists every backend, Traefik watches a provider (the Docker socket, the Kubernetes API, Consul, a file) and builds its routing table from what it finds. Start a container with the label traefik.http.routers.blog.rule=Host(`blog.example.com`) and Traefik immediately routes that host to it; stop the container and the route disappears. It is written in Go, licensed under MIT, and supports HTTP, HTTPS with automatic ACME certificates, TCP and UDP routing, middlewares (redirects, basic auth, rate limiting, headers, path stripping) and a web dashboard showing every router and service.

Use it when you run many services with Docker Compose on one host and are tired of editing proxy config for every new container, or as the Ingress controller for a Kubernetes cluster where it understands Ingress resources and its own IngressRoute CRDs. It fits the home lab and the small team especially well: one Compose file with Traefik plus labels on each service gives every app its own HTTPS hostname. For a single static site or one app on a VPS, Caddy or Nginx is simpler; Traefik’s strength is dynamic environments where services come and go.

The quickest try is Docker Compose: run the traefik:v3 image with --providers.docker, --entrypoints.websecure.address=:443 and a certificatesresolvers block for Let’s Encrypt, mount /var/run/docker.sock read-only, then add traefik.* labels to any other service in the same file. The quick start walks through exactly that and shows the dashboard on port 8080. Binaries for Linux, macOS and Windows are on the releases page, and the Helm chart installs it on Kubernetes.

Traefik is developed by Traefik Labs, which also sells an enterprise edition and API gateway, and by a large open-source community. Version 3 is the current major release; the documentation covers the migration from v2 and the concepts of entrypoints, routers, services and middlewares that every configuration is built from.