What Is Traefik? A Practical Guide to the Reverse Proxy

Traefik is a solution that helps you route traffic to containerized apps. It's a reverse proxy and load balancer built for infrastructure that changes constantly.

If you've ever added a new service, then had to remember to update a config file and reload a proxy before traffic could reach it, you've already encountered the friction Traefik was built to remove.

In this guide, you'll learn what Traefik is, what it's used for, how it works, and how it differs from a more traditional reverse proxy.

What is Traefik?

Traefik is an open-source reverse proxy and load balancer that sits in front of your applications and routes incoming requests to the right backend service. Traefik Labs, the company behind it, built it as a cloud native application proxy, designed from day one for infrastructure that's constantly created, torn down, redeployed, and changed again.

That's the core difference between Traefik and most older proxy servers. A traditional reverse proxy needs a person to edit a config file and reload the service every time a route changes.

Instead, Traefik integrates directly with the platforms running your services, from Docker and Kubernetes through to several cloud providers. It monitors your infrastructure, keeping its own routing configurations in sync with it, without requiring a human in the loop for every change.

What is Traefik used for?

At its core, Traefik handles the same job any reverse proxy handles: connecting incoming requests to the correct backend services. Teams use it for a handful of practical reasons:

• Load balancing – Traefik distributes incoming requests across multiple instances of a service.
• SSL termination – It handles HTTPS for you, decrypting traffic at the edge so backend services don't manage certificates individually.
• API gateway duties – Middleware for rate limiting and authentication, paired with flexible request routing, enables Traefik to act as a lightweight entry point for a set of internal services.
• Kubernetes ingress controller support – Traefik can sit at the edge of a cluster and route external traffic to the right pods.

These use cases are most common in cloud native applications and container service mesh setups, where services get added or replaced on a regular basis.

Essentially, Traefik makes deploying microservices easy, as the proxy layer keeps up with the services instead of trailing behind them.

How does Traefik work?

Traefik's dynamic behavior is based on a small set of building blocks and a discovery process that watches the underlying orchestration layer running beneath them.

Traefik's core building blocks

• Providers – Connect Traefik to your existing infrastructure components – Docker, Kubernetes, cloud providers, or a file – and tell it what services exist.
• Entry points – The network entry points where Traefik listens for incoming requests, typically ports like 80 and 443.
• Routers – Match incoming requests against routing rules – a hostname or a path, for example – and decide which service should handle them.
• Services – The actual services and addresses a router forwards a matched request to.
• Middleware – Optional processing steps, such as redirects, rate limiting, or authentication headers, that a request passes through first.

Service discovery in practice

Instead of relying only on manual configuration, Traefik detects changes by querying its providers directly.

It can pull service metadata from container engines, DNS system discovery, key-value stores like Consul or etcd, and cloud provider APIs, then dynamically update its routing configurations to match.

Here's what that looks like with the Docker provider, where routing lives beside the service it exposes instead of in a separate file:

services:

  app:

    image: my-app:latest

    labels:

      - "traefik.enable=true"

      - "traefik.http.routers.app.rule=Host(`app.example.com`)"

      - "traefik.http.routers.app.entrypoints=websecure"

      - "traefik.http.routers.app.tls.certresolver=letsencrypt"

      - "traefik.http.services.app.loadbalancer.server.port=3000"

When you redeploy this service, Traefik queries the Docker socket and reads those labels, then updates its routing table to match.

There's no separate config file to edit and no manual reload step, which is the same pattern Docker Compose services use inside Dokploy.

What is a Traefik reverse proxy?

A reverse proxy sits between the internet and your backend services, forwarding incoming requests to the right destination while hiding the servers behind it.

Traefik is an HTTP reverse proxy with routing control that follows your infrastructure instead of living in a static file.

The biggest difference when comparing Traefik with a high-performance web server that's grown proxy functionality over time, like Nginx, is where the routing lives.

Nginx handles proxying and load balancing well, but it's statically configured by default – you write a server block, then reload the process whenever something changes. Tools like Nginx Proxy Manager add a UI layer on top, but the underlying model is still a config file that a human maintains.

A static, manually configured reverse proxy is simpler to audit when routing rules rarely change, while Traefik is a better solution once services change often enough that keeping a config file in sync becomes a job in itself.

Read our full Traefik vs. Nginx comparison to see which would suit you best.

Traefik's extensive features

Beyond routing and load balancing, Traefik provides a set of features that are aimed squarely at cloud native applications and container service mesh setups. These features graduate Traefik from being  a bolt-on proxy to becoming a cloud native solution:

• Automatic certificate generation – Built-in ACME (Automatic Certificate Management Environment) support enables Traefik to request and renew SSL certificates from a provider like Let's Encrypt without requiring additional tools.
• A web UI – A dashboard shows active routers, services, middleware, and entry points in one place, making it useful when working out why traffic isn't reaching a service.
• Observability hooks – Access logs and Prometheus-compatible metrics connect Traefik to observability platforms without building that tooling from scratch.
• Circuit breakers and rate limiting – Middleware gives you fine-grained control over how much traffic a struggling service receives, and can stop sending it requests if it starts failing.
• Protocol support – Traefik handles WebSocket, gRPC, HTTP/2, and plain HTTP, so it covers most of the major protocols a typical service needs.

Some of Traefik's more advanced capabilities, including centralized API gateway tooling, sit behind Traefik Hub rather than the open-source core, which relies on community support through the Traefik community forum instead of a support contract.

Its no surprise, then, that Traefik has become so popular. In July 2026, for example, the company announced that it had surpassed 1,000 contributors on GitHub and 3.5 billion pulls of the official Docker image.

Of course, Traefik isn't an "everything" tool: Traefik doesn't ship with native LDAP authentication, so teams that need it added typically get it through middleware or a layer in front of Traefik.

Traefik and ingress controller support

In Kubernetes, Traefik can act as an ingress controller, sitting at the edge of a cluster and routing external traffic to backend pods.

It works with standard Kubernetes ingress resources, and also supports IngressRoute, a Traefik-specific custom resource with more routing control than standard ingress metadata allows on its own.

Maintained ingress controller support has become a more pointed issue recently. In November 2025, the Kubernetes project announced the retirement of ingress-nginx, one of the most widely deployed ingress controllers, citing years of insufficient maintainer capacity.

The project stopped receiving new releases or security patches after March 2026, which makes an actively maintained orchestrator ingress option, like Traefik's, a more practical default for new clusters.

How Dokploy uses Traefik

Dokploy is a self-hostable application deployment platform built around Docker and Docker Swarm, and it ships with Traefik by default. Three things made Traefik the right fit for that model:

1. Service discovery – Routing is configured automatically as part of the deployment flow, so you're not opening a config file every time a domain changes. 
2. Label-based configuration – Docker Compose and Swarm already give you a natural place to describe a service, and Traefik labels let routing live right beside it.
3. HTTPS – Thanks to built-in ACME support, SSL certificates get issued automatically instead of being a separate tool to wire in.

In practice, that split shows up directly in how Applications and Docker Compose services handle domains inside Dokploy. Applications use automatically managed Traefik configuration files that update without a redeploy, while Compose services use Traefik labels in the compose file itself, which do require one.

Dokploy's installation requirements reflect the same setup: ports 80 and 443 are reserved for Traefik, and port 3000 serves the Dokploy web interface.

None of this makes Nginx a bad choice. It's mature and well documented, and still the right call for teams with stable routing and deep existing Nginx expertise – you can run your own reverse proxy in front of or alongside a Dokploy deployment if you'd rather.

For Dokploy's own defaults, though, Traefik's automatic routing and certificate handling matched how a self-hosted platform needs to behave.

Conclusion

Traefik is a reverse proxy and load balancer purpose-built for infrastructure that changes frequently.

It discovers services automatically, keeping its routing configurations in sync with them, handling SSL without extra tooling along the way. That might be a better fit for your needs than a traditional, statically configured proxy, depending on how frequently your services actually change.

If you want that kind of automatic routing without setting up Traefik by hand, Dokploy's application deployment platform runs it for you out of the box.

You can sign up and have domains and HTTPS configured as part of your normal deployment flow, with routing handled the same way.

What is Traefik FAQs

Is Traefik free to use?

Yes. The core Traefik proxy is open source and free to run. Traefik Hub adds paid, enterprise-level features on top, like expanded API gateway tooling.

Is Traefik a load balancer or a reverse proxy?

Both. It forwards incoming requests to the right backend service and can distribute those requests across multiple instances of it.

Does Traefik work with Kubernetes?

Yes. Traefik supports standard Kubernetes ingress resources and its own IngressRoute custom resource, and is commonly used as an ingress controller at the edge of a cluster.

Is Traefik difficult to learn?

It has a learning curve if you're used to a single static config file, mainly because you're learning several concepts at once. Most people who work with containers daily find it easier to manage than a manually configured proxy once those concepts click.