Routing that follows your containers instead of a static config file.
Traefik reads your container labels and builds its routing table from them. Start a container with the right labels and it is routable; stop it and the route disappears. There is no config file to edit and no reload to trigger.
The model has four pieces. An entrypoint is a port Traefik listens on. A router matches requests, usually by Host header. A service is where matched requests go. A middleware sits between them and does one thing — strip a prefix, add a header, enforce basic auth.
Reach for Traefik when containers are created and destroyed by something other than you: a deployment platform, a Compose file that changes often, a Swarm cluster. Reach for nginx when the topology is static and you would rather read one explicit file than reason about label precedence.
Two problems account for most of the trouble. The first is label placement:
under Swarm, the provider reads labels from the service, so labels on the
container are simply not seen, and you get a healthy application answering 404.
The second is forwarded headers. Traefik strips X-Forwarded-Proto and
X-Forwarded-For unless the request comes from an address in the entrypoint’s
trustedIPs — which is the correct default, and which produces redirect loops
and useless access logs when it is not configured.
There is a security note worth taking seriously. Traefik’s Docker provider needs the Docker socket, and read access to that socket exposes every container’s configuration and environment. On a shared or untrusted host, put a filtering socket proxy between them rather than mounting it directly.
Start here
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.
A reading order that builds Traefik knowledge in the sequence it is actually needed.
Failure modes that come up repeatedly with Traefik, and where each one is solved.
Expose Docker services through Cloudflare with no inbound ports open — cloudflared plus Traefik, the forwarded-header setting that trips people up, and how to verify the firewall is closed.
Dokploy runs apps as Docker Swarm services, so rolling updates are already there — they just need a real health check and an update policy. Plus how to prove no request was dropped.
Traefik when containers come and go and you want routing to follow them automatically. nginx when the topology is static and you would rather have one explicit config file to read.
It is a real trade-off. Read access to the socket exposes every container and its environment variables, and a read-only mount does not change that. On a host with untrusted workloads, put a socket proxy in front of it.
Not if something upstream already terminates it — a CDN, a tunnel or a load balancer. In that case a plain HTTP entrypoint keeps the configuration smaller and removes the ACME challenge problem entirely.