# Can i add a middleware using docker labels and then reference it from a different stack?

**URL:** <https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170>\
**Category:** Traefik v3 (latest)\
**Tags:** middleware\
**Created:** [August 11, 2025, 9:08am UTC](https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170 "2025-08-11T09:08:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dinth](https://avatars.discourse-cdn.com/v4/letter/d/f17d59/32.png) [@dinth](https://community.traefik.io/u/dinth)\
**Post date:** [August 11, 2025, 9:08am UTC](https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170/1 "2025-08-11T09:08:27Z")

</div>

Hi. Basically what im trying to do is a stateless traefik, where a dynamic configuration would be defined in Traefiks own docker compose file. Im not 100% sure if its possible, but been googling around and found mixed responses.This is from my Traefik docker compose:

```auto
 \# Docker Provider       
TRAEFIK_PROVIDERS_DOCKER: "true"       
TRAEFIK_PROVIDERS_DOCKER_ENDPOINT: "tcp://traefik-socket-proxy:2375" TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: "false"      
TRAEFIK_PROVIDERS_DOCKER_NETWORK: "traefik"

    # Middleware: Security Headers (secHeaders)
      traefik.http.middlewares.securityHeaders.headers.browserXssFilter: "true"
      traefik.http.middlewares.securityHeaders.headers.contentTypeNosniff: "true"
      traefik.http.middlewares.securityHeaders.headers.forceSTSHeader: "true"
      traefik.http.middlewares.securityHeaders.headers.stsIncludeSubdomains: "true"
      traefik.http.middlewares.securityHeaders.headers.stsPreload: "true"
      traefik.http.middlewares.securityHeaders.headers.stsSeconds: "31536000"
      traefik.http.middlewares.securityHeaders.headers.customFrameOptionsValue: "SAMEORIGIN"
      traefik.http.middlewares.securityHeaders.headers.customResponseHeaders.Content-Security-Policy: 'default-src ''self''; media-src ''self'' blob:; script-src ''self'' ''unsafe-inline'' ''unsafe-eval''; style-src ''self'' ''unsafe-inline''; img-src ''self'' data: cdn.jsdelivr.net; font-src ''self'' data:; object-src ''none''; frame-ancestors ''self''; connect-src ''self'';'
      traefik.http.middlewares.securityHeaders.headers.customResponseHeaders.Referrer-Policy: 'strict-origin-when-cross-origin'
      traefik.http.middlewares.securityHeaders.headers.customResponseHeaders.Permissions-Policy: 'microphone=(), geolocation=(), payment=(), usb=(), vr=(), camera=(), display-capture=(), accelerometer=(), gyroscope=(), magnetometer=(), midi=(), xr-spatial-tracking=(), screen-wake-lock=()'
      traefik.http.middlewares.securityHeaders.headers.customResponseHeaders.X-Robots-Tag: 'noindex, nofollow, noarchive, nosnippet'
      traefik.http.middlewares.securityHeaders.headers.customResponseHeaders.X-Frame-Options: 'SAMEORIGIN'

```

and now in the container ive got this:

```auto
      traefik.http.routers.frigate.entrypoints: websecure
      traefik.http.routers.frigate.rule: Host(`cctv.${DOMAIN_NAME}`)
      traefik.http.routers.frigate.tls: "true"
      traefik.http.routers.frigate.tls.certresolver: letsencrypt
      traefik.http.routers.frigate.tls.domains[0].main: "${DOMAIN_NAME}"
      traefik.http.routers.frigate.tls.domains[0].sans: "*.${DOMAIN_NAME}"
      traefik.http.routers.frigate.middlewares: "securityHeaders@docker"
      traefik.http.services.frigate.loadbalancer.server.port: "8971"
      traefik.docker.network: "traefik"

```

Whenever i try to access that service via Traefik im getting 404 error. The middleware itself is fine, if i put exactly same middleware configuration in a dynamic configuration file and change securityHeaders@docker to securityHeaders@file, it works fine.

So my question really is - is it possible to reference a middleware defined in the Traefiks own stack from a different stack, and if so - what am i doing wrong?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 11, 2025, 9:50am UTC](https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170/2 "2025-08-11T09:50:46Z")

</div>

Yes. Taking Traefik stack from [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt), a new compose project can use the auth middleware defined in the Traefik stack:

```auto
services:

  whoami-2:
    image: traefik/whoami:v1.11.0
    hostname: whoami-2
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami-2.rule=Host(`whoami-2.example.com`)
      - traefik.http.services.mywhoami-2.loadbalancer.server.port=80
      - traefik.http.routers.mywhoami-2.middlewares=myauth

networks:
  proxy:
    name: proxy
    external: true

```

---

<div class="post-metadata">

**Author:** ![dinth](https://avatars.discourse-cdn.com/v4/letter/d/f17d59/32.png) [@dinth](https://community.traefik.io/u/dinth)\
**Post date:** [August 11, 2025, 1:29pm UTC](https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170/3 "2025-08-11T13:29:54Z")

</div>

Then i dont understand what am i doing wrong. Im not seeing anything relevant in Traefik logs, but in the example above, i am getting “middleware "securityHeaders@docker" does not exist” error message in Traefik UI

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 11, 2025, 1:47pm UTC](https://community.traefik.io/t/can-i-add-a-middleware-using-docker-labels-and-then-reference-it-from-a-different-stack/28170/4 "2025-08-11T13:47:10Z")

</div>

No idea, can't infer any issues from the short snippets you provided.

Have you tried without the docker-socket-proxy?