A Late-Night Traefik Setup Found Three Sharp Edges I Was Not Expecting

GitHub showing another strong month for traefik/traefik made me revisit a question I have asked several times as a gateway engineer: is Traefik actually a better operational choice than the reverse proxies I already know, or is it just easier to demo?

After testing it in a small Docker stack, my answer is nuanced. Traefik is excellent when infrastructure changes frequently. It watches Docker or Kubernetes metadata, discovers services, and updates routing without forcing me to hand-edit a large static configuration file. For self-hosted teams, that reduces deployment friction and makes reviewable labels or manifests part of the routing contract.

Compared with Nginx, Traefik feels much more natural in dynamic container environments. Compared with Caddy, it exposes more detailed routing, middleware, entrypoint, and provider concepts. That flexibility is useful for API gateways, but it also creates more configuration surface to govern.

The first rough edge was learning which settings belong to the static configuration and which belong to dynamic configuration. The second was security: exposing the Docker socket directly is convenient, but I would rather place a socket-proxy in front of it and grant only the required read operations.

A minimal local test looked like this:

services:
  traefik:
    image: traefik:v3.3
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
    ports:
      - "8080:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  whoami:
    image: traefik/whoami
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.rule=Host(`whoami.localhost`)
      - traefik.http.routers.whoami.entrypoints=web

The router worked immediately, but production needs more: TLS automation, access-log policy, dashboard isolation, trusted network boundaries, and external authentication or rate limiting for team API quotas. Traefik can connect these pieces, but it does not magically provide governance or zero-log privacy by itself.

My decision rule: use Traefik if you run Docker or Kubernetes and want routing to follow service discovery. Skip it if your topology is mostly static and a small, explicit Nginx configuration is easier for your team to audit.