{
  "slug": "traefik",
  "repo": "traefik/traefik",
  "name": "Traefik",
  "tagline": "Cloud-native application proxy and edge router with dynamic service discovery and automatic TLS.",
  "category": "network-vpn",
  "license_spdx": "Apache-2.0",
  "stars": 65482,
  "contributors": 860,
  "last_push_days": 0,
  "latest_release": "v3.2.0",
  "safety_score": 84.1,
  "verdict": "caution",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 6.4,
  "components": {
    "security_health": 64,
    "maintenance": 96,
    "community": 95,
    "releases": 93
  },
  "language": "Go",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "docker run -d --name traefik -p 80:80 -p 443:443 -p 8080:8080 -v /var/run/docker.sock:/var/run/docker.sock:ro -v /etc/traefik:/etc/traefik traefik:v3.2"
  },
  "ai_report": "Traefik is a modern HTTP reverse proxy and ingress controller designed specifically for microservices and cloud-native container architectures. Written in Go, Traefik dynamically discovers backend services by polling orchestration providers like Docker, Kubernetes, Nomad, and Consul without requiring process restarts or configuration file reloads. Incoming traffic is routed through a modular pipeline of entry points, routers, and middlewares that perform path rewriting, rate limiting, mutual TLS (mTLS), and forward authentication seamlessly.\n\nSecurity engineering in Traefik is backed by Traefik Labs, which maintains a formal vulnerability disclosure program and regular security patch cycles. With an OpenSSF Scorecard of 8.9, the repository enforces rigorous branch protections, continuous CodeQL security scanning, automated linting, and signed release artifacts. Automatic TLS certificate resolution via the ACME protocol (Let's Encrypt and ZeroSSL) ensures encrypted transport by default, while modern TLS configurations deprecate vulnerable cipher suites and automatically enforce HTTP/2 and HTTP/3 multiplexing.\n\nFor self-hosters and DevOps teams, the most critical security concern involves container socket exposure. Mounting `/var/run/docker.sock` directly into the container gives the process elevated privileges over the Docker daemon; administrators should instead mediate Docker API calls through a read-only socket proxy like tecnativa/docker-socket-proxy. Furthermore, the web dashboard and internal API must never be exposed publicly without robust authentication middleware or network-level IP restrictions. When configured following least-privilege principles, Traefik provides stellar performance and rock-solid reliability, earning a Healthy rating and a 95/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:19.912Z",
  "website_url": "https://traefik.io",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "ok",
    "steps": [
      {
        "title": "Get the repository",
        "detail": "Obtain the source repository and sample configuration files for Traefik.",
        "command": "git clone https://github.com/traefik/traefik"
      },
      {
        "title": "Start Traefik with Docker",
        "detail": "Run the official Docker container with your configuration file mounted.",
        "command": "docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik"
      },
      {
        "title": "Access the web UI",
        "detail": "Open the Traefik HTML frontend dashboard in your browser."
      }
    ],
    "source_url": "https://github.com/traefik/traefik#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:50:33.669Z"
  },
  "archived": false,
  "unlisted": false
}