Traefik
dragon.traefik
A Docker Compose file for Traefik alone, generated from the catalog and checked by the safety inspector. No account needed.
Reverse proxy and ingress controller that builds its routing table from live service discovery, so containers declare their own routes through labels rather than static configuration.
Traefik watches a provider — the Docker API, Kubernetes, Consul, or a configuration file — and updates its routers, services and middleware as things appear and disappear, so deploying a container with the right labels is what publishes it. Routing matches on host, path, headers and method, and middleware chains handle authentication, rate limiting, header rewriting, retries and compression between the router and the backend. Certificates are obtained and renewed over ACME per router, including through DNS challenges for hosts that are not publicly reachable. A dashboard shows the live routing table, which is what makes a misrouted request diagnosable.
You know it worked when
- The proxy starts and the dashboard lists the expected routers and services.
- A labelled container appears as a route without restarting the proxy.
- A request to the configured hostname reaches that container.
- A certificate is issued and the route serves valid HTTPS.
- A middleware such as basic authentication takes effect on the intended router only.
Known sharp edges
- It needs access to the Docker socket to discover services, which grants effective root on the host unless a filtering proxy sits between them.
- Certificate storage must be a persistent file with restricted permissions, and Traefik refuses to use it if the permissions are too open — a common first-run failure.
- The proxy and its backends must share a network, and a container with correct labels on a different network produces a route that resolves to nothing.
- The dashboard and API expose the full routing configuration and are trivially left reachable when the insecure flag is used to get started.