How to set up HTTP/3 with socket activation on the outside and HTTP/3 without socket activation on the inside? (rootless Podman + Pasta + real remote IP address)

eriksjolund · May 29, 2025, 9:38am

I opened a GitHub issue regarding panic: connection already exists

traefik fails with `panic: connection already exists` when http3 is used for both socket-activated and non-socket-activated sockets

opened 09:30AM - 29 May 25 UTC

status/0-needs-triage

### Welcome! - [x] Yes, I've searched similar issues on [GitHub](https://github….com/traefik/traefik/issues) and didn't find any. - [x] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any. ### What did you do? I tried to run traefik with rootless podman so that traefik would serve HTTP/3 to the internet with socket activation and at the same time serve HTTP/3 without socket-activation to a custom network. traefik fails with `panic: connection already exists` To reproduce: 1. Log in as an unprivileged user to a Linux system. 2. Run command ``` cat /proc/sys/net/ipv4/ip_unprivileged_port_start ``` Ensure the number is 80 or less. 3. Download [reproduce.tar.gz](https://github.com/user-attachments/files/20502031/reproduce.tar.gz) from this github issue 4. Unpack ``` tar xzf reproduce.tar.gz ``` 5. Change directory ``` cd reproduce ``` 6. Run reproducer script ``` bash reproduce.bash ``` The following output is printed ``` Trying to pull docker.io/library/traefik:latest... Getting image source signatures Copying blob 858e8b6b347f done | Copying blob 6e771e15690e done | Copying blob 3fe6a72f7e5f done | Copying blob 30408b989b42 done | Copying config 7206871bb3 done | Writing manifest to image destination 7206871bb3451f03c8939c466c0e63a9e69fa944f4aae62b4be7fe3f74725543 Certificate request self-signature ok subject=CN=test.example.com Job for traefik.service failed because the control process exited with error code. See "systemctl --user status traefik.service" and "journalctl --user -xeu traefik.service" for details. ``` ### What did you see instead? In step 6 I see ``` Job for traefik.service failed because the control process exited with error code. ``` I did not expect traefik.service to fail. In the log there is a panic ``` $ journalctl --no-pager --user -xeu traefik.service | grep "panic: connection" May 27 11:28:52 fcos-next14 systemd-traefik[67702]: panic: connection already exists ``` ### What version of Traefik are you using? Version: 3.4.1 Codename: chaource Go version: go1.23.9 Built: 2025-05-27T12:45:13Z OS/Arch: linux/arm64 ### What is your environment & configuration? Fedora CoreOS 43.20250518.91.0 podman 5.5.0 traefik 3.4.1 ```yaml $ rpm-ostree status State: idle warning: Failed to query journal: couldn't find current boot in journal Deployments: ● ostree-remote-image:fedora:docker://quay.io/fedora/fedora-coreos:rawhide Digest: sha256:8bff1ad6f521e3031e557d0ac6379d4df8a5dcd33b54440a625811e9bf464732 Version: 43.20250518.91.0 (2025-05-18T12:33:30Z) ``` Output from `podman info` <details> <summary>click me</summary> ``` host: arch: arm64 buildahVersion: 1.40.0 cgroupControllers: - cpu - memory - pids cgroupManager: systemd cgroupVersion: v2 conmon: package: conmon-2.1.13-1.fc43.aarch64 path: /usr/bin/conmon version: 'conmon version 2.1.13, commit: ' cpuUtilization: idlePercent: 99.39 systemPercent: 0.39 userPercent: 0.22 cpus: 2 databaseBackend: sqlite distribution: distribution: fedora variant: coreos version: "43" eventLogger: journald freeLocks: 2048 hostname: fcos-next14 idMappings: gidmap: - container_id: 0 host_id: 1029 size: 1 - container_id: 1 host_id: 1441792 size: 65536 uidmap: - container_id: 0 host_id: 1029 size: 1 - container_id: 1 host_id: 1441792 size: 65536 kernel: 6.15.0-0.rc5.250509g9c69f8884904.47.fc43.aarch64 linkmode: dynamic logDriver: journald memFree: 296718336 memTotal: 4078694400 networkBackend: netavark networkBackendInfo: backend: netavark dns: package: aardvark-dns-1.15.0-1.fc43.aarch64 path: /usr/libexec/podman/aardvark-dns version: aardvark-dns 1.15.0 package: netavark-1.15.0-1.fc43.aarch64 path: /usr/libexec/podman/netavark version: netavark 1.15.0 ociRuntime: name: crun package: crun-1.21-1.fc43.aarch64 path: /usr/bin/crun version: |- crun version 1.21 commit: 10269840aa07fb7e6b7e1acff6198692d8ff5c88 rundir: /run/user/1029/crun spec: 1.0.0 +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL os: linux pasta: executable: /usr/bin/pasta package: passt-0^20250512.g8ec1341-1.fc43.aarch64 version: "" remoteSocket: exists: true path: /run/user/1029/podman/podman.sock rootlessNetworkCmd: pasta security: apparmorEnabled: false capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT rootless: true seccompEnabled: true seccompProfilePath: /usr/share/containers/seccomp.json selinuxEnabled: true serviceIsRemote: false slirp4netns: executable: /usr/bin/slirp4netns package: slirp4netns-1.3.1-2.fc42.aarch64 version: |- slirp4netns version 1.3.1 commit: e5e368c4f5db6ae75c2fce786e31eef9da6bf236 libslirp: 4.8.0 SLIRP_CONFIG_VERSION_MAX: 5 libseccomp: 2.6.0 swapFree: 0 swapTotal: 0 uptime: 93h 44m 23.00s (Approximately 3.88 days) variant: v8 plugins: authorization: null log: - k8s-file - none - passthrough - journald network: - bridge - macvlan - ipvlan volume: - local registries: search: - registry.fedoraproject.org - registry.access.redhat.com - docker.io store: configFile: /var/home/test29/.config/containers/storage.conf containerStore: number: 0 paused: 0 running: 0 stopped: 0 graphDriverName: overlay graphOptions: {} graphRoot: /var/home/test29/.local/share/containers/storage graphRootAllocated: 10132369408 graphRootUsed: 8560373760 graphStatus: Backing Filesystem: xfs Native Overlay Diff: "true" Supports d_type: "true" Supports shifting: "false" Supports volatile: "true" Using metacopy: "false" imageCopyTmpDir: /var/tmp imageStore: number: 1 runRoot: /run/user/1029/containers transientStore: false volumePath: /var/home/test29/.local/share/containers/storage/volumes version: APIVersion: 5.5.0 BuildOrigin: Fedora Project Built: 1747180800 BuiltTime: Wed May 14 00:00:00 2025 GitCommit: 0dbcb51477ee7ab8d3b47d30facf71fc38bb0c98 GoVersion: go1.24.3 Os: linux OsArch: linux/arm64 Version: 5.5.0 ``` </details> output from `podman image inspect docker.io/library/traefik` <details> <summary>click me</summary> ``` [ { "Id": "7206871bb3451f03c8939c466c0e63a9e69fa944f4aae62b4be7fe3f74725543", "Digest": "sha256:5ed09f5b4d7df3bb186ba5360e7dca8dc73067ecc5278b4a26f60587db908958", "RepoTags": [ "docker.io/library/traefik:latest" ], "RepoDigests": [ "docker.io/library/traefik@sha256:5ed09f5b4d7df3bb186ba5360e7dca8dc73067ecc5278b4a26f60587db908958", "docker.io/library/traefik@sha256:cd40ab7bc1f047731d5b22595203812343efcb6538014c4e93221cfc3a77217a" ], "Parent": "", "Comment": "buildkit.dockerfile.v0", "Created": "2025-05-27T12:53:59Z", "Config": { "ExposedPorts": { "80/tcp": {} }, "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ], "Entrypoint": [ "/entrypoint.sh" ], "Cmd": [ "traefik" ], "WorkingDir": "/", "Labels": { "org.opencontainers.image.description": "A modern reverse-proxy", "org.opencontainers.image.documentation": "https://docs.traefik.io", "org.opencontainers.image.source": "https://github.com/traefik/traefik", "org.opencontainers.image.title": "Traefik", "org.opencontainers.image.url": "https://traefik.io", "org.opencontainers.image.vendor": "Traefik Labs", "org.opencontainers.image.version": "v3.4.1" } }, "Version": "", "Author": "", "Architecture": "arm64", "Os": "linux", "Size": 215927235, "VirtualSize": 215927235, "GraphDriver": { "Name": "overlay", "Data": { "LowerDir": "/var/home/test29/.local/share/containers/storage/overlay/87a5de25b7807d9015fb77ba9e565d087ccbb0633a8629909d81d2b4107af9c2/diff:/var/home/test29/.local/share/containers/storage/overlay/23c3a9e38662c9b2c8b200a5309deaaea69684ba882a3c8f2649b4a90cbb7020/diff:/var/home/test29/.local/share/containers/storage/overlay/a16e98724c05975ee8c40d8fe389c3481373d34ab20a1cf52ea2accc43f71f4c/diff", "UpperDir": "/var/home/test29/.local/share/containers/storage/overlay/b4dab3838fa09e15b0cca89ffc686d67e674ca5a15cad6154fea3fc1845a1ebc/diff", "WorkDir": "/var/home/test29/.local/share/containers/storage/overlay/b4dab3838fa09e15b0cca89ffc686d67e674ca5a15cad6154fea3fc1845a1ebc/work" } }, "RootFS": { "Type": "layers", "Layers": [ "sha256:a16e98724c05975ee8c40d8fe389c3481373d34ab20a1cf52ea2accc43f71f4c", "sha256:ee935744ec8a11e92d92c2de1f4125d45c3f6c9ce3b8142e8f03f631a834d0fd", "sha256:19782c3c5be8a4314a64db3dd47af0d62c815082e11d765bedeb08d6c302ae3a", "sha256:56ff8b88623d61326f5921a3994af0eaa62f52e7f62b4bb9691fd6dc25c3bf16" ] }, "Labels": { "org.opencontainers.image.description": "A modern reverse-proxy", "org.opencontainers.image.documentation": "https://docs.traefik.io", "org.opencontainers.image.source": "https://github.com/traefik/traefik", "org.opencontainers.image.title": "Traefik", "org.opencontainers.image.url": "https://traefik.io", "org.opencontainers.image.vendor": "Traefik Labs", "org.opencontainers.image.version": "v3.4.1" }, "Annotations": { "com.docker.official-images.bashbrew.arch": "arm64v8", "org.opencontainers.image.base.digest": "sha256:757d680068d77be46fd1ea20fb21db16f150468c5e7079a08a2e4705aec096ac", "org.opencontainers.image.base.name": "alpine:3.21", "org.opencontainers.image.created": "2025-05-27T12:53:59Z", "org.opencontainers.image.revision": "19c7156de69c027a199d78d77efc7285d9cca13e", "org.opencontainers.image.source": "https://github.com/traefik/traefik-library-image.git#19c7156de69c027a199d78d77efc7285d9cca13e:v3.4/alpine", "org.opencontainers.image.url": "https://hub.docker.com/_/traefik", "org.opencontainers.image.version": "v3.4.1" }, "ManifestType": "application/vnd.oci.image.manifest.v1+json", "User": "", "History": [ { "created": "2025-02-14T03:28:36Z", "created_by": "ADD alpine-minirootfs-3.21.3-aarch64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-02-14T03:28:36Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-05-27T12:53:59Z", "created_by": "RUN /bin/sh -c apk --no-cache add ca-certificates tzdata # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-05-27T12:53:59Z", "created_by": "RUN /bin/sh -c set -ex; \tapkArch=\"$(apk --print-arch)\"; \tcase \"$apkArch\" in \t\tarmhf) arch='armv6' ;; \t\taarch64) arch='arm64' ;; \t\tx86_64) arch='amd64' ;; \t\triscv64) arch='riscv64' ;; \t\ts390x) arch='s390x' ;; \t\tppc64le) arch='ppc64le' ;; \t\t*) echo >&2 \"error: unsupported architecture: $apkArch\"; exit 1 ;; \tesac; \twget --quiet -O /tmp/traefik.tar.gz \"https://github.com/traefik/traefik/releases/download/v3.4.1/traefik_v3.4.1_linux_$arch.tar.gz\"; \ttar xzvf /tmp/traefik.tar.gz -C /usr/local/bin traefik; \trm -f /tmp/traefik.tar.gz; \tchmod +x /usr/local/bin/traefik # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-05-27T12:53:59Z", "created_by": "COPY entrypoint.sh / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-05-27T12:53:59Z", "created_by": "EXPOSE map[80/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-05-27T12:53:59Z", "created_by": "ENTRYPOINT [\"/entrypoint.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-05-27T12:53:59Z", "created_by": "CMD [\"traefik\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-05-27T12:53:59Z", "created_by": "LABEL org.opencontainers.image.vendor=Traefik Labs org.opencontainers.image.url=https://traefik.io org.opencontainers.image.source=https://github.com/traefik/traefik org.opencontainers.image.title=Traefik org.opencontainers.image.description=A modern reverse-proxy org.opencontainers.image.version=v3.4.1 org.opencontainers.image.documentation=https://docs.traefik.io", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "NamesHistory": [ "docker.io/library/traefik:latest" ] } ] ``` </details> ### If applicable, please paste the log output in DEBUG level ``` May 27 11:28:51 fcos-next14 systemd[67433]: Starting traefik.service... ░░ Subject: A start job for unit UNIT has begun execution ░░ Defined-By: systemd ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel ░░ ░░ A start job for unit UNIT has begun execution. ░░ ░░ The job identifier is 34. May 27 11:28:51 fcos-next14 podman[67667]: 2025-05-27 11:28:51.511480251 +0000 UTC m=+0.144908258 container create 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e (image=docker.io/library/traefik:latest, name=systemd-traefik, org.opencontainers.image.url=https://traefik.io, PODMAN_SYSTEMD_UNIT=traefik.service, org.opencontainers.image.vendor=Traefik Labs, org.opencontainers.image.version=v3.4.1, org.opencontainers.image.description=A modern reverse-proxy, org.opencontainers.image.documentation=https://docs.traefik.io, org.opencontainers.image.source=https://github.com/traefik/traefik, org.opencontainers.image.title=Traefik) May 27 11:28:51 fcos-next14 podman[67667]: 2025-05-27 11:28:51.443838526 +0000 UTC m=+0.077266578 image pull 7206871bb3451f03c8939c466c0e63a9e69fa944f4aae62b4be7fe3f74725543 docker.io/library/traefik May 27 11:28:51 fcos-next14 podman[67667]: 2025-05-27 11:28:51.920917306 +0000 UTC m=+0.554345358 container init 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e (image=docker.io/library/traefik:latest, name=systemd-traefik, org.opencontainers.image.title=Traefik, org.opencontainers.image.url=https://traefik.io, PODMAN_SYSTEMD_UNIT=traefik.service, org.opencontainers.image.vendor=Traefik Labs, org.opencontainers.image.version=v3.4.1, org.opencontainers.image.description=A modern reverse-proxy, org.opencontainers.image.documentation=https://docs.traefik.io, org.opencontainers.image.source=https://github.com/traefik/traefik) May 27 11:28:51 fcos-next14 podman[67667]: 2025-05-27 11:28:51.932241962 +0000 UTC m=+0.565669970 container start 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e (image=docker.io/library/traefik:latest, name=systemd-traefik, org.opencontainers.image.source=https://github.com/traefik/traefik, org.opencontainers.image.title=Traefik, org.opencontainers.image.url=https://traefik.io, PODMAN_SYSTEMD_UNIT=traefik.service, org.opencontainers.image.vendor=Traefik Labs, org.opencontainers.image.version=v3.4.1, org.opencontainers.image.description=A modern reverse-proxy, org.opencontainers.image.documentation=https://docs.traefik.io) May 27 11:28:51 fcos-next14 traefik[67667]: 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:105 > Traefik version 3.4.1 built on 2025-05-27T12:45:13Z version=3.4.1 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:112 > Static configuration loaded [json] staticConfiguration={"entryPoints":{"web":{"address":"0.0.0.0:80","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"redirections":{"entryPoint":{"permanent":true,"priority":9223372036854775806,"scheme":"https","to":"websecure"}},"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"web2":{"address":"0.0.0.0:80","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"redirections":{"entryPoint":{"permanent":true,"priority":9223372036854775806,"scheme":"https","to":"websecure2"}},"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"websecure":{"address":"0.0.0.0:443","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true,"tls":{}},"http2":{"maxConcurrentStreams":250},"http3":{},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"websecure2":{"address":"0.0.0.0:443","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true,"tls":{}},"http2":{"maxConcurrentStreams":250},"http3":{},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}}},"global":{"checkNewVersion":true},"log":{"format":"common","level":"DEBUG"},"providers":{"file":{"filename":"/file.yaml","watch":true},"providersThrottleDuration":"2s"},"serversTransport":{"insecureSkipVerify":true,"maxIdleConnsPerHost":200},"tcpServersTransport":{"dialKeepAlive":"15s","dialTimeout":"30s"}} May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:634 > May 27 11:28:52 fcos-next14 systemd-traefik[67702]: Stats collection is disabled. May 27 11:28:52 fcos-next14 systemd-traefik[67702]: Help us improve Traefik by turning this feature on :) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: More details on: https://doc.traefik.io/traefik/contributing/data-collection/ May 27 11:28:52 fcos-next14 systemd-traefik[67702]: May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z WRN github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:475 > Unable to use socket activation for entrypoint error="unable to find socket activation TCP listener for entryPoint" entryPointName=web2 name=web2 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z WRN github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:475 > Unable to use socket activation for entrypoint error="unable to find socket activation TCP listener for entryPoint" entryPointName=websecure2 name=websecure2 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z WRN github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp_http3.go:44 > Unable to use socket activation for entrypoint error="unable to find socket activation UDP listener for entryPoint" entryPointName=websecure2 name=websecure2 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z INF github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:73 > Starting provider aggregator *aggregator.ProviderAggregator May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:224 > Starting TCP Server entryPointName=web2 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:224 > Starting TCP Server entryPointName=web May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:224 > Starting TCP Server entryPointName=websecure May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG log/log.go:245 > 2025/05/27 11:28:52 sys_conn.go:36: failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. May 27 11:28:52 fcos-next14 systemd-traefik[67702]: 2025-05-27T11:28:52Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:224 > Starting TCP Server entryPointName=websecure2 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: panic: connection already exists May 27 11:28:52 fcos-next14 systemd-traefik[67702]: May 27 11:28:52 fcos-next14 systemd-traefik[67702]: goroutine 54 [running]: May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.(*connMultiplexer).AddConn(0x40005001c0, {0xffff69ca56a0?, 0x4000855ce0?}) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/multiplexer.go:59 +0x194 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.(*Transport).init.func1() May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/transport.go:266 +0x3b0 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: sync.(*Once).doSlow(0x10?, 0x10?) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: sync/once.go:76 +0xf8 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: sync.(*Once).Do(...) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: sync/once.go:67 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.(*Transport).init(0x4000d96800, 0x0?) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/transport.go:225 +0x50 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.(*Transport).createServer(0x4000d96800, 0x40003d1880, 0x4000de7440, 0x1) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/transport.go:175 +0xfc May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.(*Transport).ListenEarly(0x4000312b30?, 0x0?, 0x0?) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/transport.go:153 +0x20 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go.ListenEarly({0x7dd67c0, 0x4000855ce0}, 0x40003d1880, 0x4000de7440) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/server.go:235 +0x74 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go/http3.init.func1({0x7dd67c0?, 0x4000855ce0?}, 0x400065d8f0?, 0x6f066a2?) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/http3/server.go:29 +0x24 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go/http3.(*Server).setupListenerForConn(0x4000d713b0, 0x40003d0000, {0x7dd67c0, 0x4000855ce0}) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/http3/server.go:378 +0x1b8 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go/http3.(*Server).Serve(0x4000d713b0, {0x7dd67c0?, 0x4000855ce0?}) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/quic-go/quic-go@v0.48.2/http3/server.go:268 +0x44 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/traefik/traefik/v3/pkg/server.(*http3server).Start(...) May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp_http3.go:87 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/traefik/traefik/v3/pkg/server.(*TCPEntryPoint).Start.func1() May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:227 +0x30 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: created by github.com/traefik/traefik/v3/pkg/server.(*TCPEntryPoint).Start in goroutine 13 May 27 11:28:52 fcos-next14 systemd-traefik[67702]: github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:227 +0xac May 27 11:28:52 fcos-next14 podman[67719]: 2025-05-27 11:28:52.526547438 +0000 UTC m=+0.088842518 container died 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e (image=docker.io/library/traefik:latest, name=systemd-traefik, org.opencontainers.image.vendor=Traefik Labs, org.opencontainers.image.version=v3.4.1, PODMAN_SYSTEMD_UNIT=traefik.service, org.opencontainers.image.description=A modern reverse-proxy, org.opencontainers.image.documentation=https://docs.traefik.io, org.opencontainers.image.source=https://github.com/traefik/traefik, org.opencontainers.image.title=Traefik, org.opencontainers.image.url=https://traefik.io) May 27 11:28:52 fcos-next14 podman[67719]: 2025-05-27 11:28:52.740495748 +0000 UTC m=+0.302790783 container remove 1af69324d165e19080b0e233d8b9e12599dab43c498d490f7a8d8a2cde26ae9e (image=docker.io/library/traefik:latest, name=systemd-traefik, org.opencontainers.image.url=https://traefik.io, org.opencontainers.image.vendor=Traefik Labs, org.opencontainers.image.version=v3.4.1, PODMAN_SYSTEMD_UNIT=traefik.service, org.opencontainers.image.description=A modern reverse-proxy, org.opencontainers.image.documentation=https://docs.traefik.io, org.opencontainers.image.source=https://github.com/traefik/traefik, org.opencontainers.image.title=Traefik) May 27 11:28:52 fcos-next14 systemd[67433]: traefik.service: Main process exited, code=exited, status=2/INVALIDARGUMENT ░░ Subject: Unit process exited ░░ Defined-By: systemd ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel ░░ ░░ An ExecStart= process belonging to unit UNIT has exited. ░░ ░░ The process' exit code is 'exited' and its exit status is 2. May 27 11:28:52 fcos-next14 systemd[67433]: traefik.service: Failed with result 'exit-code'. ░░ Subject: Unit failed ░░ Defined-By: systemd ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel ░░ ░░ The unit UNIT has entered the 'failed' state with result 'exit-code'. May 27 11:28:52 fcos-next14 systemd[67433]: Failed to start traefik.service. ░░ Subject: A start job for unit UNIT has failed ░░ Defined-By: systemd ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel ░░ ░░ A start job for unit UNIT has finished with a failure. ░░ ░░ The job identifier is 34 and the job result is failed. May 27 11:28:52 fcos-next14 systemd[67433]: traefik.service: Consumed 1.220s CPU time, 33.1M memory peak. ░░ Subject: Resources consumed by unit runtime ░░ Defined-By: systemd ░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel ░░ ░░ The unit UNIT completed and consumed the indicated resources. ```

Topic		Replies	Views
Traefik+docker socket proxy / doesn't seems to work Traefik v2 docker	34	4164	April 8, 2024
Replacing docker socket with podman sockets Traefik v3 (latest) docker , cli	4	808	May 13, 2025
Unable to Route Quadlets Through Traefik Traefik v3 (latest) docker	7	211	September 5, 2025
TCP connection w/ and w/o TLS does not work. Pass through works to ngnix to handle the TCP stream Traefik v2 tcp	7	3584	November 24, 2019
How can I make Traefik v3 work with podman? Traefik v3 (latest) docker	3	8595	March 11, 2025

How to set up HTTP/3 with socket activation on the outside and HTTP/3 without socket activation on the inside? (rootless Podman + Pasta + real remote IP address)

Related topics