Traefik not creating routers from docker labels

Traefik Traefik v3 (latest)
1

Hi there

I am trying to move from a .yaml to docker labels based system. However, Traefik sometimes doesn't create routers from given docker labels. Sometimes it does, and I cannot for the life of me figure out why.

This is my current docker-compose.yaml for Traefik:

services:
  traefik:
    image: traefik:v3.7
    container_name: traefik

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./dynamic:/etc/traefik/dynamic:ro"
      - "./letsencrypt:/letsencrypt"

    network_mode: host

    command:
      # general traefik settings
      - --log.level=DEBUG
      - --accessLog.format=json
      - --accessLog.filepath=/dev/stdout
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker.exposedByDefault=false
      - --providers.file.directory=/etc/traefik/dynamic


      # entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entryPoint.permanent=true


      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.asDefault=true
      - --entrypoints.websecure.http.middlewares=vpnonly@file

      - --entrypoints.public.address=:8443

      # certificates resolvers
      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true


    labels:
      # dashboard
      - traefik.enable=true
      - traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_USERHASH}


      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_HOST}`)
      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
      - traefik.http.routers.traefik-dashboard.tls=true
      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
      - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth@docker
      - traefik.http.routers.traefik-dashboard.service=api@internal

networks:
  main-bridge:
    external: true

As you can see, it correctly gets assigned the docker labels:

"traefik.enable": "true",
"traefik.http.middlewares.traefik-auth.basicauth.users": "admin:hashvalue",
"traefik.http.routers.traefik-dashboard.entrypoints": "websecure",
"traefik.http.routers.traefik-dashboard.middlewares": "traefik-auth@docker",
"traefik.http.routers.traefik-dashboard.rule": "Host(traefik.example.de)",
"traefik.http.routers.traefik-dashboard.service": "api@internal",
"traefik.http.routers.traefik-dashboard.tls": "true",
"traefik.http.routers.traefik-dashboard.tls.certresolver": "letsencrypt"

However, when inspecting the actual routers, traefik-dashboard is missing completely (Only the internal, predefined routes, if I am not mistaken). Pihole for example is there, and a fritzbox.yaml exists too.
This issue with labels happened before with a different container (maybe netbird? Dont quite recall), so I doubt its dashboard-related.

admin@raspberry:\~/homelab/services/traefik $ curl -s http://127.0.0.1:8080/api/http/routers | jq
\[
{
"entryPoints": \[
"traefik"
\],
"service": "api@internal",
"rule": "PathPrefix(/api)",
"ruleSyntax": "default",
"priority": 9223372036854775806,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"traefik"
\],
"name": "api@internal",
"provider": "internal",
"priorityStr": "9223372036854775806"
},
{
"entryPoints": \[
"traefik"
\],
"middlewares": \[
"dashboard_redirect@internal",
"dashboard_stripprefix@internal"
\],
"service": "dashboard@internal",
"rule": "PathPrefix(/)",
"ruleSyntax": "default",
"priority": 9223372036854775805,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"traefik"
\],
"name": "dashboard@internal",
"provider": "internal",
"priorityStr": "9223372036854775805"
},
{
"entryPoints": \[
"websecure"
\],
"middlewares": \[
"vpnonly@file",
"vpnonly@file"
\],
"service": "fritzbox",
"rule": "Host(fritzbox.redtoxyl.de)",
"priority": 28,
"tls": {
"options": "default",
"certResolver": "letsencrypt"
},
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"websecure"
\],
"name": "fritzbox@file",
"provider": "file",
"priorityStr": "28"
},
{
"entryPoints": \[
"websecure"
\],
"middlewares": \[
"vpnonly@file"
\],
"service": "pihole",
"rule": "Host(pihole.redtoxyl.de)",
"priority": 26,
"tls": {
"options": "default",
"certResolver": "letsencrypt"
},
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"websecure"
\],
"name": "pihole@docker",
"provider": "docker",
"priorityStr": "26"
},
{
"entryPoints": \[
"web"
\],
"middlewares": \[
"redirect-web-to-websecure@internal"
\],
"service": "noop@internal",
"rule": "HostRegexp(^.+$)",
"ruleSyntax": "default",
"priority": 9223372036854775806,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"web"
\],
"name": "web-to-websecure@internal",
"provider": "internal",
"priorityStr": "9223372036854775806"
}
\]

Thank you in advance for any advice :slight_smile:

2

Docker containers are used for isolation, so usually you would only open required ports.

Remove this, as it sets some defaults, which are not used when you use your own router:

3

Sorry for the late reply. This did fix things; but why does network mode affect label discovery? And why does it only break for some services, not all?