Traefik v3 — The Practical Reverse Proxy Guide for Docker in 2026

Why Fora Soft wrote this guide

Fora Soft has shipped real-time video, AI, and SaaS products since 2005, with 625+ delivered software products and a 100% job-success score on Upwork. Behind every one of those products there’s a reverse proxy doing the boring, important work: TLS termination, routing, rate-limiting, basic auth, header rewrites. This article is the Traefik configuration we actually run — not a Hello World.

The original version of this post won the 2022 HackerNoon Noonies for Containers (proof). What you’re reading is the 2026 update: Traefik v3, HTTP/3, wildcard certificates, OpenTelemetry tracing, and the security middleware we add as a default in production. If you want the engineers who run that stack on real customer-facing products, jump to the closing CTA.

What Traefik is, in one paragraph

Traefik is a cloud-native reverse proxy and load balancer that watches your service registry (Docker, Kubernetes, Consul, Nomad, ECS) and configures routes from labels — with no static nginx.conf. You declare a Docker container with a label like traefik.http.routers.api.rule=Host(`api.example.com`), the container starts, Traefik picks it up, requests a Let’s Encrypt certificate, and starts routing traffic. Service stops → route disappears. That’s the entire mental model.

Traefik vs NGINX vs Caddy — pick by churn, not by hype

A minimal production-shaped traefik.yml

This is the static config we start every project from. It defines the entry points (HTTP and HTTPS), redirects HTTP→HTTPS, enables the Docker provider, sets up an ACME certificate resolver against Let’s Encrypt, and turns on the dashboard. Comments use #.

# traefik.yml — static config

log:
  level: INFO

api:
  dashboard: true
  insecure: true   # only safe behind ssh-tunnel; lock down in prod

providers:
  docker:
    network: traefik
    exposedByDefault: false   # opt-in per service via labels

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
          permanent: true
  https:
    address: ":443"
    http3: {}                 # enable HTTP/3 in v3

certificatesResolvers:
  simple-resolver:
    acme:
      email: ops@example.com
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: http

accessLog: true
metrics:
  prometheus: {}              # /metrics endpoint for Prometheus

Companion docker-compose.yml

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"                       # HTTP/3 needs UDP 443
      - "127.0.0.1:8080:8080"               # dashboard, ssh-tunnel only
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - /data/letsencrypt:/letsencrypt
    networks:
      - traefik

  whoami:
    image: traefik/whoami
    restart: always
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.whoami.rule=Host(`example.com`)
      - traefik.http.routers.whoami.entrypoints=https
      - traefik.http.routers.whoami.tls.certresolver=simple-resolver
      - traefik.http.services.whoami.loadbalancer.server.port=80
    networks:
      - traefik

networks:
  traefik:
    external: true

Run docker network create traefik once, then docker compose up -d. Hit https://example.com — you should see the whoami output and a green padlock.

Reaching the dashboard safely

The dashboard is bound to 127.0.0.1:8080 on the host, so it’s not exposed to the internet. Open it via SSH port-forward:

ssh -L 8080:localhost:8080 root@example.com
# then open http://localhost:8080 in your browser

For dashboards that need to be available remotely without SSH, expose it through Traefik itself behind a basic-auth middleware (next section).

Useful middlewares we ship by default

Three middlewares cover 90% of real-world needs: basic auth, security headers, and rate limiting.

# add to a service’s labels in docker-compose.yml

# 1) basic auth on the dashboard
- traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$Cyl...   # use htpasswd

# 2) security headers (HSTS, X-Frame, content-type)
- traefik.http.middlewares.sec-headers.headers.stsSeconds=31536000
- traefik.http.middlewares.sec-headers.headers.stsIncludeSubdomains=true
- traefik.http.middlewares.sec-headers.headers.contentTypeNosniff=true
- traefik.http.middlewares.sec-headers.headers.browserXssFilter=true
- traefik.http.middlewares.sec-headers.headers.frameDeny=true

# 3) rate limit
- traefik.http.middlewares.api-rl.ratelimit.average=50
- traefik.http.middlewares.api-rl.ratelimit.burst=100

# attach two middlewares to a router
- traefik.http.routers.api.middlewares=sec-headers,api-rl

Note the doubled $$ in the basic-auth string — Compose interpolates a single $, so you have to escape it. Generate the hash with htpasswd -nb admin yourPassword.

Wildcard certificates with DNS-01

For multi-tenant SaaS where every customer gets a subdomain — acme.example.com, tenant42.example.com — you don’t want a separate cert per tenant. Use a wildcard via DNS-01.

# traefik.yml — add a second resolver
certificatesResolvers:
  wildcard-resolver:
    acme:
      email: ops@example.com
      storage: /letsencrypt/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

# docker-compose.yml — add Cloudflare API token + wildcard router
services:
  traefik:
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_token
    secrets:
      - cf_token

  api:
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=HostRegexp(`{tenant:[a-z0-9-]+}.example.com`)
      - traefik.http.routers.api.entrypoints=https
      - traefik.http.routers.api.tls.certresolver=wildcard-resolver
      - traefik.http.routers.api.tls.domains[0].main=example.com
      - traefik.http.routers.api.tls.domains[0].sans=*.example.com

secrets:
  cf_token:
    file: ./cloudflare-token.txt

Cloudflare, Route 53, GCloud DNS, DigitalOcean, OVH and a long list of others are supported. The provider list is in the official docs.

Migrating from Traefik v2 to v3

Traefik v3 is the version we run on new projects in 2026. The migration is gentle: Docker labels mostly stay the same, and the dynamic-config syntax remains backward-compatible during the transition.

What changes: a small set of static-config option renames, plugin manifests, and the experimental flags promoted to GA. What stays the same: your Docker labels, your routers/services/middlewares model, your ACME storage. Read the official v2→v3 migration guide before bumping the image tag.

Why upgrade: HTTP/3, OpenTelemetry, WASM middleware, Kubernetes Gateway API, SPIFFE for workload identity. The performance ceiling is also higher in v3.

HTTP/3 and QUIC, in three lines

Add http3: {} to your HTTPS entry point and open UDP 443 on the host. Browsers will negotiate HTTP/3 automatically; existing HTTP/1.1 and HTTP/2 clients keep working as before. Real-time-video and edge-served apps benefit most because QUIC tolerates packet loss without TCP-level head-of-line blocking. We default it on for edge-AI surveillance and mobile streaming deployments.

Observability: logs, metrics, and OpenTelemetry traces

Three things we always wire in:

1. Access logs. JSON-formatted, shipped to Loki or CloudWatch. Request ID, latency, status, route name — the basics. Set accessLog.format: json.

2. Prometheus metrics. Enable metrics.prometheus; scrape /metrics. Watch traefik_router_request_duration_seconds_bucket and tail latencies per route.

3. OpenTelemetry traces (v3 native). Point Traefik at your OTLP collector and you get end-to-end traces from edge through your services. Replaces the v2 Jaeger/Zipkin/Datadog drivers with a single OTLP target.

Five Traefik pitfalls we see most often

1. Exposing the dashboard with api.insecure: true on a public port. The dashboard reveals all your routes and certificates. Always bind it to 127.0.0.1 or hide it behind basic-auth + a router with api@internal.

2. Forgetting the Docker network. If your service container is on a different network than Traefik, no labels in the world will route to it. Add traefik.docker.network=traefik and put both on the same network.

3. Hitting Let’s Encrypt rate limits. ACME has hard rate limits (50 certificates per registered domain per week). Use caServer: https://acme-staging-v02.api.letsencrypt.org/directory for testing.

4. Not persisting acme.json. If you don’t mount /letsencrypt as a volume, every container restart re-issues certificates and you hit the rate limit fast. Mount it; chmod 600.

5. Routing collisions across stacks. Two services with the same Host() rule will fight non-deterministically. Use unique router names and explicit priority labels (traefik.http.routers.X.priority=10) when overlapping rules are unavoidable.

Scaling Traefik beyond a single host

Single-host Traefik is fine up to 10–30k RPS depending on hardware. Beyond that you have three options: (a) run multiple Traefik instances behind a Layer-4 load balancer (HAProxy, AWS NLB) with shared ACME storage; (b) run Traefik on Kubernetes as the cluster Ingress controller; (c) run Traefik Hub for managed multi-cluster ingress. We default to option (b) on K8s and (a) on Compose-based fleets. We covered scale architecture more broadly in our scalable VMS guide.

Cost and effort to wire Traefik into a real product

Our quotes come in below legacy SI vendors for the same scope because we use Agent Engineering to compress the rote configuration and audit phases. The hard parts — security review, ACME edge cases, observability wiring — still take human attention.

When you should NOT pick Traefik

Three honest cases. 1. A single-tenant, low-churn front-end where you already run NGINX and the team knows it — the migration cost will exceed the operational gain. 2. Extreme RPS at a single edge box (50k+ RPS/core); NGINX still wins on raw throughput. 3. Environments where you cannot mount the Docker socket or grant the Kubernetes API permissions Traefik needs — air-gapped or strictly-zero-trust shops sometimes hit this.

FAQ

What to Read Next

Need a backend, DevOps or video-infra partner who actually ships?

Traefik is a small piece of the picture — the harder questions are usually about service decomposition, observability, secret management, real-time streaming, and what to put on the edge. Those are the questions we answer for clients across SaaS, surveillance, edutainment, and creator monetization.

If you want a quick second opinion on your reverse-proxy / ingress setup, or a partner to build the backend behind it, the fastest way to start is a 30-minute call with our engineering lead.