Hands-on Lab

Traefik Reverse Proxy with Docker

July 17, 2026 3 min

0 / 8

Cheat sheet

Found it useful? Don't miss the next lab

0:00 / 0:00

We write a compose.yaml with three services. Traefik mounts /var/run/docker.sock read-only (:ro) so it can read, but never change, the containers' state; --providers.docker.network=web tells it which network to search for backends when there's more than one; and we publish port 80 (traffic) and 8080 (API) to the host. nginx-demo and whoami only carry traefik.enable=true and a Host(`domain`) rule: those labels are the entire routing configuration Traefik needs.

mkdir -p /root/traefik-lab && cat > /root/traefik-lab/compose.yaml <<'EOF'
services:
  traefik:
    image: traefik:v3.7.8
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=web"
      - "--entrypoints.web.address=:80"
      - "--api=true"
      - "--api.insecure=true"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - web
  nginx-demo:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nginx-demo.rule=Host(`nginx.local`)"
      - "traefik.http.routers.nginx-demo.entrypoints=web"
      - "traefik.http.services.nginx-demo.loadbalancer.server.port=80"
    networks:
      - web
  whoami:
    image: traefik/whoami:v1.11.0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.local`)"
      - "traefik.http.routers.whoami.entrypoints=web"
    networks:
      - web
networks:
  web:
    name: web
EOF

I did it

We confirm the compose.yaml is syntactically valid before starting anything: config --quiet resolves it internally and prints nothing when there are no errors, so the final echo only shows up once validation has passed.

docker compose -f /root/traefik-lab/compose.yaml config --quiet && echo 'compose.yaml is valid'

We bring up all three services at once. Docker Compose first creates the web network, then starts Traefik, nginx-demo, and whoami attached to it; Traefik starts watching the socket the moment it boots, so it discovers the other two containers without any extra step from us.

docker compose -f /root/traefik-lab/compose.yaml up -d

I did it

We confirm all three containers are up (Up) and that Traefik is publishing ports 80 and 8080 on the host. If any of them were missing here, its corresponding route simply would not exist yet.

docker compose -f /root/traefik-lab/compose.yaml ps --format 'table {{.Name}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}'

We look at the labels the whoami container actually carries, exactly as Traefik reads them off the socket. There is no separate file anywhere: traefik.enable and the Host(`whoami.local`) rule live attached to the container itself.

docker inspect --format '{{json .Config.Labels}}' "$(docker compose -f /root/traefik-lab/compose.yaml ps -q whoami)" | jq

I did it

We request http://localhost/ without specifying any host Traefik knows about. Since neither the Host(`nginx.local`) nor the Host(`whoami.local`) rule matches 'localhost', Traefik answers 404 on its own: the request never reaches any backend container. This makes it clear routing depends entirely on the Host header, not the port.

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/

I did it

Now we send the same request but with the Host: nginx.local header. Traefik finds the matching rule and forwards the traffic to the nginx-demo container, which returns its default welcome page. This is the proof that Host-based routing works end to end.

curl -s -H 'Host: nginx.local' http://localhost/ | grep -i 'Welcome to nginx'

I did it

We repeat the test with Host: whoami.local. The response is no longer nginx's: it's the whoami container describing itself (its hostname and internal IP), confirming Traefik routed each domain to a different container using the exact same running instance's rules.

curl -s -H 'Host: whoami.local' http://localhost/ | grep -E 'Hostname|IP'

I did it

Instead of opening the dashboard, we read Traefik's API directly on port 8080: /api/http/routers returns each discovered router as JSON, with its name and rule. It's the same data the web panel draws as a table, and the definitive proof that the nginx-demo and whoami labels turned into real configuration.

curl -s http://localhost:8080/api/http/routers | jq -r '.[] | select(.name | contains("@docker")) | "\(.name): \(.rule)"'

I did it

With the lab done, we stop and remove all three containers, the web network, and any anonymous volumes they created. down -v leaves the system exactly as it was before we started.

docker compose -f /root/traefik-lab/compose.yaml down -v

I did it

We confirm no traefik-lab container is left (the count should be 0) and that the web network no longer shows up in docker network ls: cleanup was complete and nothing is left running in the background.

echo "remaining traefik-lab containers: $(docker ps -a --filter name=traefik-lab --format '{{.Names}}' | wc -l)"; docker network ls --format '{{.Name}}' | grep -x web || echo 'network web removed'

Was this lab useful? Rate it:

Click to rate this post!

[Total: 0 Average: 0]

What this lab does

Traefik with Docker solves a concrete problem: exposing several containers on port 80 without reserving a separate port for each one. In this lab you install Traefik as a reverse proxy with its Docker provider, bring up two backends with routing labels, and use curl to prove each hostname reaches the right container.

Labels instead of configuration files

Everything is declared in a single compose.yaml, the approach recommended by the official Docker Compose documentation: Traefik mounts the Docker socket read-only, listens on port 80, and exposes its API on port 8080. Each backend adds traefik.http.routers.<name>.rule=Host(`domain`), and Traefik recomputes its routes the moment it spots the container, with nothing to restart. We covered the same per-container networking pattern in our Docker networking guide: bridge, host, and custom networks.

How it fits with the rest of the stack

If you’re used to managing certificates and domains by hand, compare this declarative approach with our guide to installing Nginx Proxy Manager with Docker, which solves the same problem from a web UI. To keep an eye on the containers Traefik will route to, our Portainer with Docker Compose lab is a good companion. Traefik’s source is public on its GitHub repository. Find more self-hosting guides under the Tools category and the rest of our reproducible walkthroughs in the hands-on labs.

FAQ

What is Traefik?

Traefik is a reverse proxy and load balancer built for container environments. Instead of maintaining a routes file by hand, it watches the Docker socket and builds its configuration dynamically from the labels you attach to each container.

How does Traefik know which container to send a request to?

Each container carries a traefik.http.routers.<name>.rule label with a condition, usually Host(`domain`). When a request arrives, Traefik matches the Host header against those rules and forwards the traffic to the container whose rule matches.

Is it safe to use –api.insecure=true in production?

No. That flag exposes Traefik's dashboard and API without authentication, which is only acceptable for local testing like this lab. In production it should sit behind authentication and, typically, the API port should not be published externally.

How is Traefik different from Nginx Proxy Manager?

Nginx Proxy Manager is managed mostly through its web UI, adding each domain by hand. Traefik is configured declaratively with labels on each container, so a new service is routed the moment it starts, without opening any admin panel.

Cheat sheet

mkdir -p /root/traefik-lab && cat > /root/traefik-lab/compose.yaml <<'EOF'
services:
  traefik:
    image: traefik:v3.7.8
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=web"
      - "--entrypoints.web.address=:80"
      - "--api=true"
      - "--api.insecure=true"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - web
  nginx-demo:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nginx-demo.rule=Host(`nginx.local`)"
      - "traefik.http.routers.nginx-demo.entrypoints=web"
      - "traefik.http.services.nginx-demo.loadbalancer.server.port=80"
    networks:
      - web
  whoami:
    image: traefik/whoami:v1.11.0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.local`)"
      - "traefik.http.routers.whoami.entrypoints=web"
    networks:
      - web
networks:
  web:
    name: web
EOF

docker compose -f /root/traefik-lab/compose.yaml up -d

docker inspect --format '{{json .Config.Labels}}' "$(docker compose -f /root/traefik-lab/compose.yaml ps -q whoami)" | jq

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost/

curl -s -H 'Host: nginx.local' http://localhost/ | grep -i 'Welcome to nginx'

curl -s -H 'Host: whoami.local' http://localhost/ | grep -E 'Hostname|IP'

curl -s http://localhost:8080/api/http/routers | jq -r '.[] | select(.name | contains("@docker")) | "\(.name): \(.rule)"'

docker compose -f /root/traefik-lab/compose.yaml down -v

Found it useful? Don't miss the next lab

Subscribe to the newsletter

What this lab does

Labels instead of configuration files

How it fits with the rest of the stack

FAQ

What is Traefik?

How does Traefik know which container to send a request to?

Is it safe to use –api.insecure=true in production?

How is Traefik different from Nginx Proxy Manager?

Cheat sheet