# Traefik not creating routers from docker labels

**URL:** <https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235>\
**Category:** Traefik v3 (latest)\
**Tags:** docker\
**Created:** [September 10, 2026, 2:54pm UTC](https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235 "2026-09-10T14:54:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RedToxyl](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@RedToxyl](https://community.traefik.io/u/RedToxyl)\
**Post date:** [September 10, 2026, 2:54pm UTC](https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235/1 "2026-09-10T14:54:51Z")

</div>

Hi there

I am trying to move from a .yaml to docker labels based system. However, Traefik sometimes doesn't create routers from given docker labels. Sometimes it does, and I cannot for the life of me figure out why.

This is my current docker-compose.yaml for Traefik:

```yaml
services:
  traefik:
    image: traefik:v3.7
    container_name: traefik

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./dynamic:/etc/traefik/dynamic:ro"
      - "./letsencrypt:/letsencrypt"

    network_mode: host

    command:
      # general traefik settings
      - --log.level=DEBUG
      - --accessLog.format=json
      - --accessLog.filepath=/dev/stdout
      - --api.dashboard=true
      - --api.insecure=true
      - --providers.docker.exposedByDefault=false
      - --providers.file.directory=/etc/traefik/dynamic

      # entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entryPoint.permanent=true

      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.asDefault=true
      - --entrypoints.websecure.http.middlewares=vpnonly@file

      - --entrypoints.public.address=:8443

      # certificates resolvers
      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true

    labels:
      # dashboard
      - traefik.enable=true
      - traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_USERHASH}

      - traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_HOST}`)
      - traefik.http.routers.traefik-dashboard.entrypoints=websecure
      - traefik.http.routers.traefik-dashboard.tls=true
      - traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt
      - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth@docker
      - traefik.http.routers.traefik-dashboard.service=api@internal

networks:
  main-bridge:
    external: true

```

As you can see, it correctly gets assigned the docker labels:

```json
"traefik.enable": "true",
"traefik.http.middlewares.traefik-auth.basicauth.users": "admin:hashvalue",
"traefik.http.routers.traefik-dashboard.entrypoints": "websecure",
"traefik.http.routers.traefik-dashboard.middlewares": "traefik-auth@docker",
"traefik.http.routers.traefik-dashboard.rule": "Host(traefik.example.de)",
"traefik.http.routers.traefik-dashboard.service": "api@internal",
"traefik.http.routers.traefik-dashboard.tls": "true",
"traefik.http.routers.traefik-dashboard.tls.certresolver": "letsencrypt"

```

However, when inspecting the actual routers, traefik-dashboard is missing completely (Only the internal, predefined routes, if I am not mistaken). Pihole for example is there, and a fritzbox.yaml exists too.  
This issue with labels happened before with a different container (maybe netbird? Dont quite recall), so I doubt its dashboard-related.

```json
admin@raspberry:\~/homelab/services/traefik $ curl -s http://127.0.0.1:8080/api/http/routers | jq
\[
{
"entryPoints": \[
"traefik"
\],
"service": "api@internal",
"rule": "PathPrefix(/api)",
"ruleSyntax": "default",
"priority": 9223372036854775806,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"traefik"
\],
"name": "api@internal",
"provider": "internal",
"priorityStr": "9223372036854775806"
},
{
"entryPoints": \[
"traefik"
\],
"middlewares": \[
"dashboard_redirect@internal",
"dashboard_stripprefix@internal"
\],
"service": "dashboard@internal",
"rule": "PathPrefix(/)",
"ruleSyntax": "default",
"priority": 9223372036854775805,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"traefik"
\],
"name": "dashboard@internal",
"provider": "internal",
"priorityStr": "9223372036854775805"
},
{
"entryPoints": \[
"websecure"
\],
"middlewares": \[
"vpnonly@file",
"vpnonly@file"
\],
"service": "fritzbox",
"rule": "Host(fritzbox.redtoxyl.de)",
"priority": 28,
"tls": {
"options": "default",
"certResolver": "letsencrypt"
},
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"websecure"
\],
"name": "fritzbox@file",
"provider": "file",
"priorityStr": "28"
},
{
"entryPoints": \[
"websecure"
\],
"middlewares": \[
"vpnonly@file"
\],
"service": "pihole",
"rule": "Host(pihole.redtoxyl.de)",
"priority": 26,
"tls": {
"options": "default",
"certResolver": "letsencrypt"
},
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"websecure"
\],
"name": "pihole@docker",
"provider": "docker",
"priorityStr": "26"
},
{
"entryPoints": \[
"web"
\],
"middlewares": \[
"redirect-web-to-websecure@internal"
\],
"service": "noop@internal",
"rule": "HostRegexp(^.+$)",
"ruleSyntax": "default",
"priority": 9223372036854775806,
"observability": {
"accessLogs": true,
"metrics": true,
"tracing": true,
"traceVerbosity": "minimal"
},
"status": "enabled",
"using": \[
"web"
\],
"name": "web-to-websecure@internal",
"provider": "internal",
"priorityStr": "9223372036854775806"
}
\]

```

Thank you in advance for any advice 🙂

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 10, 2026, 3:01pm UTC](https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235/2 "2026-09-10T15:01:40Z")

</div>

> [@RedToxyl](#):
>
> `network_mode: host`

Docker containers are used for isolation, so usually you would only open required ports.

Remove this, as it sets some defaults, which are not used when you use your own router:

> [@RedToxyl](#):
>
> `--api.insecure=true`

---

<div class="post-metadata">

**Author:** ![RedToxyl](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@RedToxyl](https://community.traefik.io/u/RedToxyl)\
**Post date:** [September 13, 2026, 10:36am UTC](https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235/3 "2026-09-13T10:36:16Z")

</div>

Sorry for the late reply. This did fix things; but why does network mode affect label discovery? And why does it only break for some services, not all?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [September 16, 2026, 10:36am UTC](https://community.traefik.io/t/traefik-not-creating-routers-from-docker-labels/30235/4 "2026-09-16T10:36:17Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.