SSH Workbench

Traefik Label Generator

Build Traefik v2/v3 Docker labels visually for docker-compose.

Client-side only — nothing leaves your browser

Label syntax is identical between v2 and v3 for these options.

Used as router/service identifier

Port your app listens on inside the container

Comma-separate for multiple hosts: a.example.com, b.example.com

Name of the certificatesResolver from your traefik.yml

Reference middlewares defined elsewhere (file provider, other containers).

Set when the container is on multiple networks

    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.myapp-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.myapp-https-redirect.redirectscheme.permanent=true"
      - "traefik.http.routers.myapp.rule=Host(`app.example.com`)"
      - "traefik.http.routers.myapp.entrypoints=web"
      - "traefik.http.routers.myapp.service=myapp"
      - "traefik.http.routers.myapp.middlewares=myapp-https-redirect"
      - "traefik.http.routers.myapp-secure.rule=Host(`app.example.com`)"
      - "traefik.http.routers.myapp-secure.entrypoints=websecure"
      - "traefik.http.routers.myapp-secure.service=myapp"
      - "traefik.http.routers.myapp-secure.tls=true"
      - "traefik.http.routers.myapp-secure.tls.certresolver=letsencrypt"
      - "traefik.http.services.myapp.loadbalancer.server.port=3000"

Paste under your service in docker-compose.yml. Indentation is YAML-correct.

What Are Traefik Docker Labels?

Traefik labels are key-value pairs you attach to a Docker container that tell Traefik how to route traffic to it. When the Docker provider is enabled, Traefik watches the Docker socket for containers carrying labels with the traefik.* prefix and dynamically builds routers, services, and middlewares from them — no separate config file edit required. This makes labels the standard way to expose containers behind Traefik in docker-compose, Docker Swarm, and Portainer setups.

Anatomy of a Traefik Label

Every Traefik label follows the same dotted-key structure. The first segment is always traefik, followed by the resource type (router, service, middleware), the resource name, and the property being set.

LabelPurpose
traefik.enable=trueOpt this container into Traefik routing
traefik.http.routers.<name>.ruleMatch expression (Host, Path, Headers...)
traefik.http.routers.<name>.entrypointsWhich entrypoint(s) to listen on (web, websecure)
traefik.http.routers.<name>.tls=trueTerminate TLS for this router
traefik.http.routers.<name>.tls.certresolverName of the cert resolver (e.g. letsencrypt)
traefik.http.routers.<name>.middlewaresComma-separated middleware chain to apply
traefik.http.services.<name>.loadbalancer.server.portPort the container listens on internally
traefik.docker.networkPick a specific network when container is on many

Common Traefik Middlewares

MiddlewareWhat it does
redirectschemeForce HTTP requests to redirect to HTTPS
stripprefixRemove a leading path before forwarding to the backend
addprefixPrepend a path before forwarding
basicauthRequire HTTP basic authentication (htpasswd users)
headersSet, replace, or remove request/response headers
ipallowlistAllow only specific source IP ranges (v3)
ratelimitThrottle requests per source
compressgzip-compress responses
forwardauthDelegate auth to an external service (Authelia, Authentik)

Frequently Asked Questions

What is the difference between Traefik labels and a config file?
Traefik has two configuration layers: static config (traefik.yml or CLI flags) defines entrypoints, providers, and certificate resolvers — these require a Traefik restart to change. Dynamic config (routers, services, middlewares) can come from a file provider, the Docker provider (labels), Kubernetes CRDs, Consul, etc. Labels are just dynamic config attached to a container — Traefik watches the Docker socket and applies them live, with no restart. Use static config for things that rarely change, and labels for per-container routing rules.
Why are my Traefik labels not working?
The most common causes: (1) the container isn't on the same Docker network as Traefik — add it to the proxy network or set traefik.docker.network. (2) traefik.enable=true is missing and exposedByDefault is false. (3) The router name in the label doesn't match across rule/entrypoints/service lines. (4) The loadbalancer.server.port doesn't match the port the app actually listens on inside the container — Traefik uses the container port, not the host-mapped port. (5) For docker-compose, dollar signs in basic-auth htpasswd values aren't doubled ($$) and YAML parses them as variables.
How do I configure multiple hosts or middlewares with labels?
For multiple hosts in one router, combine them in the rule: Host(`a.example.com`) || Host(`b.example.com`). For multiple middlewares, list them comma-separated in a single label: traefik.http.routers.myapp.middlewares=auth,strip-prefix,headers. They run in the order listed, left to right. If you need different middleware chains for HTTP vs HTTPS, define two routers (myapp and myapp-secure) and set the middlewares label on each independently.
Are Traefik v2 and v3 labels the same?
For the labels this generator produces (routers, services, redirectscheme, stripprefix, basicauth, TLS, cert resolvers), the syntax is identical between v2 and v3 — your generated labels work on both. The breaking changes in v3 are mostly elsewhere: Kubernetes CRD apiVersion changed from traefik.containo.us/v1alpha1 to traefik.io/v1alpha1, ipWhiteList was renamed to ipAllowList, and some experimental features moved. Plain Docker label users rarely need to change anything when upgrading from v2 to v3.
Can I use Traefik with Docker without labels?
Yes. The Docker provider is one of many — you can disable it and use the file provider instead, defining all your routers, services, and middlewares in a YAML or TOML file that Traefik watches for changes. This is preferred when you want config in version control alongside Traefik itself, when containers run on a different host than Traefik, or for routes that don't map to a single container (external services, TCP routers to non-Docker backends). You can also mix both — labels for app containers and a file for shared middlewares like a global IP allowlist.

Related Tools

Cron Expression Generator

Build and validate cron schedules visually

→

SSH Key Generator

Generate SSH key pairs in your browser

→

Need to manage SSH connections?

SSH Workbench lets you connect, browse files, and manage servers visually.

Try SSH Workbench Free