Traefik Proxy: Choosing Between Docker Labels and File-Based Routing

The Routing Decision: Automatic Discovery vs. Static Control

When configuring Traefik Proxy, the primary engineering decision is how to define your routing rules: should the configuration live alongside the application (Docker labels) or in a centralized configuration directory (File provider)?

The choice depends on whether your priority is developer velocity—where adding a container automatically creates a route—or centralized governance—where a network administrator controls all entry points regardless of the container's state.

Comparison of Routing Providers

Feature	Docker Provider	File Provider
Configuration Location	Container Labels	YAML/TOML Files
Service Discovery	Automatic (via Docker Socket)	Manual Definition
Lifecycle Coupling	Tied to container lifecycle	Decoupled from containers
External Service Support	Limited/Complex	Native (via LoadBalancer)
Security Profile	Requires access to docker.sock	Read-only file access

Trade-offs and Constraints

The Docker Provider: High Velocity, Higher Risk

The Docker provider monitors the Docker socket for events. When a container starts with specific traefik.http labels, Traefik automatically generates the router and service. This is ideal for microservices architectures where services are frequently added or scaled.

The Risk: To function, Traefik must mount /var/run/docker.sock. If the Traefik container is compromised, the attacker potentially gains root-level control over the entire Docker host. Additionally, as the number of services grows, auditing your routing table requires searching through multiple docker-compose.yml files across different repositories.

The File Provider: Strict Control, Manual Effort

The File provider reads configuration from a directory. It is the only viable option for routing traffic to services running outside of Docker, such as a legacy database on a VM or an external API gateway.

The Constraint: Every change requires a file update. While Traefik supports hot-reloading (applying changes without a restart), it removes the "magic" of automatic discovery. You must manually track the IP addresses or DNS names of your backend services.

Implementation Example: Hybrid Configuration

Many production environments use a hybrid approach: Docker labels for internal microservices and the File provider for global middleware (like IP whitelists) or external endpoints.

Step 1: Enable Providers in Static Configuration

Run this in your traefik.yml (static config) with root permissions to ensure the binary can read the specified paths:

providers:
  docker:
    exposedByDefault: false
  file:
    directory: /etc/traefik/dynamic/
    watch: true

Step 2: Define a Docker-based Route

In your application's docker-compose.yml, add labels to the service. Traefik will detect these upon docker compose up -d:

services:
  webapp:
    image: my-app:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.webapp.rule=Host(`app.example.com`)"
      - "traefik.http.services.webapp.loadbalancer.server.port=80"

Step 3: Define an External Route via File

Create a file at /etc/traefik/dynamic/external-services.yml. This allows you to route to a server not managed by Docker:

http:
  routers:
    legacy-api:
      rule: "Host(`api.legacy.com`)"
      service: legacy-service
  services:
    legacy-service:
      loadBalancer:
        servers:
          - url: "http://10.0.0.50:8080"

Verification and Validation

To verify the configuration is active without restarting the proxy:

1. Dashboard Check: Access the Traefik Dashboard (usually port 8080). Confirm that both webapp (from Docker) and legacy-api (from File) appear in the HTTP Routers list.
2. Log Validation: Check the Traefik container logs for the following strings: "Provider docker" and "Configuration loaded from file".
3. Connectivity Test: Run curl -I http://app.example.com. If you receive a response, the Docker provider is correctly mapping the label to the container IP.

Rollback Procedure

Because these changes modify the routing state:

• For Docker: Remove the traefik.enable=true label from the container and run docker compose up -d to refresh the state.
• For File: Delete the .yml file from the /etc/traefik/dynamic/ directory. Traefik will remove the route automatically upon detecting the file deletion.