Traefik

What Traefik actually is

Traefik is an open-source reverse proxy, load balancer and ingress controller built for dynamic infrastructure. It started at Containous SAS in Lyon, France — Traefik 1.0 ("reblochon") shipped in July 2016 — and the company rebranded to Traefik Labs in 2020, now operating as Traefik Labs SAS in Lyon with a US subsidiary in San Francisco. The core proposition has not changed since that first release: a proxy that configures itself from the infrastructure it sits in front of. Point it at Docker, Kubernetes, Consul or a dozen other providers, and it discovers services as they appear, routes to them, and tears the routes down when they leave.

The technical surface is broad for a single Go binary. HTTP/1, HTTP/2 and HTTP/3, gRPC, WebSockets, TCP and UDP routing. Automatic TLS certificate provisioning through Let's Encrypt (ACME), with renewal handled for you. A built-in dashboard and API, real-time metrics to Prometheus, Datadog, StatsD or InfluxDB, distributed tracing via OpenTelemetry/Jaeger/Zipkin, and an extension system (Yaegi-interpreted Go plugins and WebAssembly plugins) with a public plugin catalog. On Kubernetes it works as an ingress controller and has been one of the more active implementers of the Gateway API — the successor specification to Ingress that the project has backed publicly since 2024.

Licensing is the clean part of the story: Traefik Proxy is MIT-licensed (the license file covers 2016-2020 Containous and 2020-2025 Traefik Labs), so the full proxy is free for commercial use, modification and redistribution. The commercial layer is Traefik Hub — an API gateway and API-management platform built on the same data plane, with WAF, advanced auth (LDAP, JWT, HMAC, OAuth2, OIDC, OPA), HashiCorp Vault integration, multi-cluster management, FIPS 140-2 compliance, a developer portal with declarative API lifecycle CRDs, and add-ons for AI gateway and MCP gateway workloads. If you only need a proxy, you never touch Hub; if you need API management on top, Hub is where the company makes money.

Pricing: what you really pay

For the proxy itself: nothing. No license fee, no seat count, no per-service charge. Run it on a €5 VPS or across a hundred nodes; the MIT license does not care. Support in that tier is community support — GitHub issues and the community forum — which is the honest trade: free software, no support contract.

Traefik Hub is where pricing gets opaque. The commercial tiers — Hub API Gateway, Hub API Management, and the AI/MCP gateway add-ons — are gated behind a "Get Pricing" sales form on traefik.io; no dollar amounts are published on the pricing page. A 30-day free trial is available for the API Gateway tier. The one place we found hard numbers is the AWS Marketplace contract listing, which prices annual licenses by support level: Hub Basic at $30,000 per 12 months (8x5 support), Hub MC at $40,000 per 12 months (24x7 support, 2-hour response SLA) and Hub UMC at $50,000 per 12 months (24x7 support, 30-minute response SLA). Those three differ in support commitment, not product capability. Third-party guides circulate a "Hub Pro at $99 per month" figure; we could not verify it against any Traefik-controlled page and treat it as unreliable.

Our read: the free tier is genuinely free and complete for proxy duty, which is why Traefik runs in a large share of Kubernetes shops. The commercial tier is enterprise-contract software, priced accordingly, and the sales-gated pricing page is the weakest transparency point in an otherwise well-documented project. If your budget is in the low hundreds per month, you are an open-source Traefik user, not a Hub customer.

Performance & infrastructure

Traefik is software, so there is no datacenter to evaluate — the infrastructure is whatever you deploy it on. What we can assess is the engineering around it. The project is written in Go, distributed as a single static binary and a small container image, and its configuration model is declarative: file or TOML config plus dynamic discovery from container orchestrators, with hot-reloading so service changes do not require proxy restarts. That architecture is why it became the default ingress choice for Docker Compose and a mainstream Kubernetes ingress: the proxy tracks the orchestrator instead of requiring config management around the proxy.

On the ecosystem, Traefik is one of the most widely deployed cloud-native proxies there is — GitHub stars, plugin catalog and community content all indicate a large installed base, and the vendor (45-ish people, Series A, roughly $10M raised in 2020) has kept a consistent release cadence through v3.x, with recent work on Gateway API support and an AI gateway. Docs live at docs.traefik.io and cover the reference material properly; the observability story (Prometheus metrics, OpenTelemetry tracing, access logs) is built in rather than bolted on.

We have not benchmarked Traefik against NGINX, Envoy or HAProxy — our 2026-04-01 test set measures VMs, not proxies, and we will not invent numbers here. The performance claims in circulation (including Hub's "23x faster WAF") are vendor claims and should be read as such. What is architecturally true: as a Go-based edge proxy, Traefik trades raw peak throughput against NGINX/Envoy (both C/C++) for dramatically lower configuration overhead and native orchestrator integration. For most self-managed teams that trade is right; for a 100 Gbps edge doing minimum-latency TLS termination, benchmark before you commit.

On reliability and support honesty: the proxy's track record in production is long and wide, but there is no published uptime SLA for Traefik Hub's managed components, and support is sold as response-time SLAs (8x5, or 24x7 with 2-hour or 30-minute response commitments on the marketplace contracts) rather than availability credits. That is normal for this product class and we score it as stated, not as promised uptime.

Where it falls short

The free-versus-paid line is the first thing to understand. Advanced authentication, WAF, multi-cluster management, FIPS compliance, GitOps tooling for APIs and the developer portal all live in Hub, and Hub pricing is sales-gated. Teams that start on the open-source proxy and later need, say, OIDC auth at the edge often discover that the feature they want is one contract negotiation away — alternatives like nginx or Envoy plus a separate auth layer may be cheaper in money and dearer in time, but the option should be a conscious choice.

Second, Traefik's configuration ergonomics cut both ways. Auto-discovery is magic until it is not: debugging a missing route means reasoning about what the provider sees, what the middleware chain does, and what priority rules resolved to. The docs explain each piece; they cannot explain your cluster. Teams new to dynamic proxies report a learning curve specifically around middleware ordering and entrypoint semantics, and the error surface is friendlier in v3 than v2 but still deeper than a static NGINX config.

Third, benchmarking posture. If you need predictable maximum throughput and byte-level control of buffering, keep-alives and worker models, NGINX and Envoy give you more dials and more published numbers. Traefik optimizes for operational simplicity, and it should be judged on that axis — but the trade is real.

Finally, the company itself is a small venture-backed vendor. The MIT core removes most of the lock-in risk — you can fork, patch and run forever — but Hub customers depend on a 45-person company's continued execution, and the EULA includes license-key phone-home verification for commercial installs.

Who should pick this

Our pick for teams running Docker Compose or Kubernetes who want TLS, routing and service discovery solved with the least ongoing configuration work. It is the natural choice for platform teams standardizing on Kubernetes ingress with Gateway API ambitions, for multi-service stacks where services come and go, and for anyone who wants Let's Encrypt handled automatically across many hostnames without cert-manager gymnastics (though cert-manager integration also works). See /category/load-balancers for the proxy comparison field and /category/container-platforms for the orchestrator context.

We would not pick it as a purchased API-management platform without first pricing Kong, cloud-provider gateways and Apigee against an actual Hub quote — the marketplace numbers put Hub solidly in enterprise budget territory. And we would benchmark NGINX and Envoy alongside it for high-throughput edge roles. For the free proxy tier, though, this is one of the easiest recommendations in our catalog.

Key takeaways

• MIT-licensed open-source proxy/ingress since 2016 (Traefik Labs, Lyon, France): auto service discovery, automatic Let's Encrypt, HTTP/2-3, gRPC, TCP/UDP, built-in metrics and tracing.
• The proxy is genuinely free for commercial use; support is community-based at that tier.
• Traefik Hub (API gateway/management, WAF, OIDC/JWT/OPA auth, multi-cluster, FIPS, developer portal) is sales-gated; AWS Marketplace lists $30,000-$50,000 per year by support tier, with 30-day free trial on the gateway tier.
• Deep Kubernetes integration including Gateway API work; plugin catalog via Go and WebAssembly extensions.
• No published uptime SLA and no vendor benchmark data; raw throughput trades against NGINX/Envoy in exchange for configuration simplicity.
• Small vendor behind the commercial tier — low lock-in risk on the OSS core, real dependency risk on Hub.

Sources

• https://github.com/traefik/traefik/blob/master/LICENSE.md
• https://traefik.io/legal/end-user-license-agreement
• https://traefik.io/author/emile
• https://plans.apis.io/plans/traefik/traefik-plans-pricing
• https://github.com/api-evangelist/traefik/blob/main/plans/traefik-plans-pricing.yml
• https://aws.amazon.com.rproxy.goskope.com/marketplace/pp/prodview-km45cgw54goeg
• https://apiscout.dev/guides/best-api-gateway-solutions-2026
• https://platform.tracxn.com/a/d/company/575d03a6e4b076e475be7c6c/traefik