Limits

An honest account of where Traefik's world ends, including the parts the project's own marketing steps around.

It is not a web server. Nothing in Traefik serves your files or runs your application. Every setup in this guide has a real service behind the proxy; if what you need is "put these static pages on the internet", chapter 13's Caddy or Nginx is the smaller tool.

Publication is the default posture. A router that matches is a site the network can reach, on whatever networks the entrypoint listens to. Traefik has no notion of "draft". The disciplines that keep that safe are yours: entrypoints bound deliberately, exposedByDefault: false in Docker, authentication on admin things, and a dashboard that is not public property (chapter 8).

Forwarded headers are a trust decision. Traefik tells backends the visitor's address and requested name via X-Forwarded-*. A backend that trusts those headers from anyone — because someone later exposes it directly, bypassing the proxy — can be lied to about who is visiting. Traefik has settings for which proxies it trusts; the chain of trust is a design question, and the proxy does not answer it for you.

BasicAuth is small arms. Chapter 6 said it plainly: a lock for admin corners, weak over HTTP, with browsers that cannot log out. Traefik offers stronger middleware (forward-auth to a real identity service, OIDC in the commercial and plugin ecosystem), but the moment identity matters, identity is a system of its own and the proxy is its customer, not its replacement.

The single binary is a single point. One Traefik is one process on one machine; when it stops, every name it served stops. Pairs and clusters exist in the Traefik world (and managed offerings), but at the scale of this guide the mitigation is chapter 11's: a configuration so small and rehearsed that rebuilding the door is a five- minute errand, not an outage plan written in advance by hope.

Dynamic configuration trusts its sources. Anyone who can write to the watched folder, or set labels on containers, can re-route your sites. That is not a flaw — it is the mechanism working — but it makes the folder, the Docker socket, and the Kubernetes API permissions part of your security surface, which surprises people who thought of them as plumbing.

TCP and UDP are narrower than HTTP. Traefik routes TCP streams (by SNI name, mostly) and UDP datagrams, and this guide did not exercise either: there is no HTTP-style middleware, no path rules, no equivalent of the chapters above. Non-web protocols are a documented capability, not a taught one here.

Rate limits and retries are not a shield. The middleware catalogue includes rate limiting, circuit breaking and retries, which smooth accidents politely. Against deliberate abuse they are a speed bump in front of chapter 13's sterner tools and a firewall. Nothing in this guide was tested under hostile load, and no claim about behaviour under attack is made anywhere in it.