Hi everyone,
I’m running Traefik as a Docker container on Debian 12.1, with Docker version 28.2.2 (build e6534b4), and I’ve recently noticed a huge increase in internal DNS queries coming from several containers in my setup.
Each of my services (Nextcloud, Vaultwarden, Homepage, etc.) runs in its own Docker container, and:
- Each container has its own dedicated Docker network (e.g. Nextcloud_network, Vaultwarden_network, etc.) with static IPs and subnets.
- All containers are also connected to a shared traefik_network, where they each have a static IP as well.
- All services are routed through Traefik using labels like :
"traefik.enable=true"
"traefik.http.routers.nextcloud.rule=Host(nextcloud.domain.com)"
What I’m observing:
Every container routed through Traefik (not just Traefik itself) is sending thousands of DNS queries for internal domains like nextcloud.domain.com, vaultwarden.domain.com, homepage.domain.com, etc.
These internal domains now show up as the top permitted domains in Pi-hole, with tens of thousands of hits daily.
This spike in DNS traffic started right after setting up Traefik.
What I’ve tried:
I created a custom /etc/hosts file mapping all *.domain.com subdomains to their static IPs in traefik_network, and mounted it into the Traefik container (./etc_hosts:/etc/hosts:ro).
This worked for name resolution inside Traefik (ping succeeded), but didn’t stop the DNS traffic.
Worse, it broke DNS resolution for other clients (e.g., phone via WireGuard), so I reverted it.
My questions:
-
Why are containers behind Traefik constantly resolving internal domains, even when IPs are static and known?
-
Is this a known behavior in a reverse proxy setup like this?
-
Would using IP-based routing or aliases in Docker Compose reduce this?
-
Is there a way to prevent or cache DNS lookups properly across services when using Traefik?
Thanks in advance for any tips or guidance — happy to share more details if needed.