ConfigClarity › Glossary › Traefik Labels

Traefik Labels

Traefik labels are Docker Compose metadata that tell the Traefik reverse proxy how to route traffic to a container — defining hostnames, TLS settings, middleware, and service ports.
TraefikDockerReverse ProxyLabelsRoutingTLS

Traefik uses Docker labels to auto-configure routing without a static config file. When Traefik discovers a container with routing labels, it automatically creates routes, applies middleware, and manages TLS certificates — all from the Docker Compose file itself.

The label system changed significantly between Traefik v2 and v3. Labels written for v2 will not work in v3, and the failure mode is silent — Traefik starts but the route is simply not created.

Traefik v2 Label Syntax

traefik.http.routers.app.rule=Host(`app.domain.com`)
traefik.http.routers.app.tls.certresolver=letsencrypt
traefik.http.services.app.loadbalancer.server.port=3000

Breaking Changes in v3

Traefik v3 removed the traefik.frontend.* and traefik.backend.* label prefixes used in v1. Several v2 features changed defaults: allowEmptyServices was removed, Docker provider requires explicit network configuration, and some middleware parameters were renamed.

Related Tools

Reverse Proxy Mapper →

Fix Guides

Traefik v2 to v3 migration fix

Frequently Asked Questions

Why are my Traefik labels not working after upgrading to v3?
Traefik v3 removed several v2 label patterns and changed defaults. The most common issue is using old traefik.frontend.* labels from v1 (which were already deprecated in v2). Use ConfigClarity's Reverse Proxy Mapper — it detects v2 labels and generates the exact v3 replacements.
Do I need to restart Traefik when I change labels?
No. Traefik watches the Docker socket for container events and updates its routing configuration dynamically. Changing labels and redeploying the container (docker compose up -d) is enough — Traefik picks up the new labels within seconds.
What is the minimum Traefik label set needed to route a container?
At minimum: traefik.enable=true, traefik.http.routers.NAME.rule=Host(`domain.com`), and traefik.http.services.NAME.loadbalancer.server.port=PORT. For HTTPS add traefik.http.routers.NAME.tls.certresolver=letsencrypt.