Problem Scenario
After upgrading to Docker 29 in a Swarm environment (GCP VM, Ubuntu 22) and deploying Traefik v3.x for reverse-proxy/HTTPS, custom domains returned self-signed certificate errors and Traefik failed to create routers for stack service labels.
Sample error in Traefik logs:
text
ERR github.com/traefik/traefik/v3/pkg/provider/docker/pswarm.go:89 >
Failed to retrieve information of the docker client and server host error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version" providerName=swarm
Browser/curl output:
text
SSL certificate problem: self-signed certificate
404 page not found
Diagnosis
-
Docker 29 raised the minimum supported API version to 1.44.
-
Traefik v3's Swarm provider tries to negotiate using legacy API version 1.24.
-
In Docker Swarm mode, Traefik needs API access for service listing, label application, and automatic ACME/Let's Encrypt SSL issuance.
-
This bug affects only the Docker 29 + Swarm + Traefik v3 combination. Docker 28 or Traefik v2 works normally.
Possible Solutions
1. Downgrade Traefik to v2.x
Change the Traefik image to v2.10.x or v2.11.x and redeploy your Swarm stack:
text
image: traefik:v2.11.3
Everything works again—service routers are detected and certificates issued correctly.
2. Workaround: Set min-api-version in daemon.json
Edit /etc/docker/daemon.json to allow older API version:
json
{
"min-api-version": "1.24"
}
Commands:
bash
sudo nano /etc/docker/daemon.json
# Add above block; save file.
sudo systemctl restart docker
This "tricks" Traefik's Swarm provider, allowing v3 to operate with Docker 29 and correctly identify services/routers.
3. Docker downgrade (not recommended)
Downgrading Docker Engine to v28 works, but is rarely appropriate in cloud production.
Working Solution Used
Workaround: Set min-api-version (Option 2 above):
bash
sudo nano /etc/docker/daemon.json
# Add:
{
"min-api-version": "1.24"
}
sudo systemctl restart docker
After this, Traefik v3 works normally on Docker 29 Swarm, routers are discovered, ACME/Let's Encrypt certificates issued as expected.
References
In short:
-
The issue is caused by Traefik v3 Swarm Provider not recognizing Docker 29's new minimum API version.
-
You have two easy choices: downgrade Traefik to v2, or set
"min-api-version": "1.24"in daemon.json and restart Docker. -
With the workaround, Traefik v3 + Docker 29 + Swarm again supports custom domain routers and Let's Encrypt SSL out of the box.