Skip to content

Installing Traefik

Traefik ships as one static binary. No runtime, no dependency tree, nothing to compile: download it, make it executable, run it. There are also official packages and a Docker image, and on Kubernetes a Helm chart; this chapter installs the binary because it is the same program on every platform, it is what the lab ran, and it leaves the fewest questions about where things live.

The version matters more than the method. This guide's lab verified Traefik v3.7.16. Traefik is on its third major version; configuration written for v2 mostly works in v3 but not always, and the internet is full of both. When a search result contradicts this chapter, check which version it is talking about before believing either of you is wrong.

Step 1: download, and check the download

From the project's releases page on GitHub, take the archive for your operating system and processor, and the checksums file published beside it:

curl -LO https://github.com/traefik/traefik/releases/download/v3.7.16/traefik_v3.7.16_linux_amd64.tar.gz
curl -LO https://github.com/traefik/traefik/releases/download/v3.7.16/traefik_v3.7.16_checksums.txt
grep linux_amd64.tar.gz traefik_v3.7.16_checksums.txt \
  | sha256sum -c -
tar xzf traefik_v3.7.16_linux_amd64.tar.gz traefik

Check: the checksum line answers traefik_v3.7.16_linux_amd64.tar.gz: OK, and ./traefik version prints the version, codename and build date (transcript t00). Verifying the checksum takes ten seconds and is the difference between "probably the project's binary" and "the project's binary". A proxy that fetches executables for other machines is worth those ten seconds every time.

On Windows and macOS the same page offers windows_amd64 and darwin_amd64 / darwin_arm64 archives; the binary and this guide's configuration files work the same way. On Windows, curl in these chapters means the real curl, which Windows 10 and 11 include.

Step 2: the static configuration

One file, traefik.yml, beside the binary. The lab's is short enough to read whole, and examples/traefik.yml keeps it:

entryPoints:
  web:
    address: ":8000"
  websecure:
    address: ":8443"

api:
  insecure: true
  dashboard: true

ping:
  entryPoint: traefik

providers:
  file:
    directory: ./dynamic
    watch: true

log:
  level: INFO

Three honest remarks about it:

  1. The ports are laboratory ports. A real front door listens on 80 (named web) and 443 (websecure) — the names are convention, the numbers are the standard ones. The lab used 8000 and 8443 so it could never collide with anything real. To use the real ports on Linux, the binary needs permission to bind below 1024 — run it as root, or grant the capability with setcap 'cap_net_bind_service=+ep'.
  2. api.insecure: true is a lab setting, not a recommendation. It exposes the dashboard and API, with no password at all, on port 8080. That is deliberate here so chapter 8 can show everything plainly — and chapter 8 also shows how to put it behind authentication and why, on any machine you care about, you must.
  3. watch: true is the whole show. It tells the file provider to apply edits as they land. Without it, dynamic files are read once, like static ones.

Step 3: run it

./traefik --configFile=traefik.yml

Check: in another terminal,

curl -s http://127.0.0.1:8080/ping

answers OK. The ping stanza above is what makes that endpoint exist; a healthy Traefik with no routers yet is still a healthy Traefik, which is why the check is the ping and not a website. Starting with no dynamic/ folder at all is fine too — Traefik simply knows no routes until a provider teaches it some, which is chapter 4's job.

For a permanent home, run it under your service manager (systemd on Linux) with the binary and both configuration folders somewhere stable like /opt/traefik/. Chapter 11 returns to looking after it.