Traefik — Dependencies#

Module info#

• Module: github.com/traefik/traefik/v3
• Go version: 1.25.0
• Direct dependencies: ~118 (first require block in go.mod)
• Indirect dependencies: ~285 explicitly listed in go.mod; go.sum has 2034 lines (~1017 resolved module/version entries total)

Dependency categories#

Core infrastructure / Configuration#

• github.com/traefik/paerser v0.2.2 — Traefik’s own config parsing library (born from this project; handles TOML, YAML, env vars, and CLI flags uniformly). This is a deliberate extraction into a standalone lib.
• github.com/BurntSushi/toml v1.6.0 — TOML file parsing for static config
• gopkg.in/yaml.v3 v3.0.1 — YAML config parsing
• github.com/mitchellh/mapstructure — map-to-struct conversion (heavy use in config decoding)
• github.com/mitchellh/copystructure, hashstructure — deep copy and hashing of config structs for change detection
• github.com/fatih/structs v1.1.0 — runtime struct introspection for config reflection
• github.com/fsnotify/fsnotify v1.9.0 — file system watching for dynamic file provider
• github.com/vulcand/predicate v1.3.0 — DSL predicate/rule evaluation (routing rules like Host(), PathPrefix())
• github.com/Masterminds/sprig/v3 — template helper functions
• github.com/tidwall/gjson v1.17.0 — fast JSON querying without full unmarshal
• github.com/tufanbarisyildirim/gonginx — nginx config parsing (for nginx ingress controller support)

Networking / HTTP / Proxy#

• github.com/gorilla/mux v1.8.1 (forked as containous/mux) — HTTP router; Traefik maintains a private fork adding features needed for its routing model
• github.com/gorilla/websocket v1.5.4 — WebSocket upgrade handling
• github.com/containous/alice — HTTP middleware chaining (composing middleware pipelines functionally)
• github.com/quic-go/quic-go v0.59.0 — HTTP/3 / QUIC protocol support
• github.com/andybalholm/brotli v1.2.0 — Brotli compression for responses
• github.com/klauspost/compress v1.18.2 — gzip, deflate, snappy, zstd compression
• github.com/valyala/fasthttp v1.69.0 — high-performance HTTP (used in specific internal paths)
• github.com/pires/go-proxyproto v0.8.1 — PROXY protocol v1/v2 for preserving client IPs through load balancers
• github.com/traefik/grpc-web v0.16.0 — gRPC-Web bridging (HTTP/1.1 → gRPC)
• google.golang.org/grpc v1.79.3 — gRPC transport
• github.com/armon/go-socks5 — SOCKS5 proxy support
• github.com/abbot/go-http-auth (forked) — HTTP Basic/Digest authentication middleware
• github.com/miekg/dns v1.1.72 — DNS client (ACME DNS challenges, DNS provider)
• github.com/unrolled/secure v1.0.9 — HTTP security headers middleware (HSTS, CSP, etc.)
• github.com/unrolled/render v1.0.2 — HTTP response templating (for dashboard API)
• golang.org/x/net, crypto, sys, sync, time, text, mod, tools — standard extended stdlib

Middleware / Proxy Internals#

• github.com/vulcand/oxy/v2 (forked as traefik/oxy) — core proxy utilities: streaming, buffering, load-balancing algorithms, forward proxy, circuit breaker wrappers. Traefik maintains a fork for v2+ behavior.
• github.com/mailgun/ttlmap (forked) — TTL-expiring map for rate limiting state
• github.com/patrickmn/go-cache — in-memory TTL cache (used for IP-based rate limiting buckets)
• github.com/cenkalti/backoff/v4 — exponential backoff for retries middleware
• go.uber.org/ratelimit (indirect) — token bucket rate limiter
• github.com/sony/gobreaker (indirect) — circuit breaker implementation

Observability#

• github.com/rs/zerolog v1.33.0 — primary structured logger (fast, zero-allocation JSON logging)
• github.com/sirupsen/logrus v1.9.3 — legacy logger (still used in older code paths and some providers)
• github.com/go-kit/kit v0.13.0, go-kit/log — go-kit logging abstraction (used by some provider integrations)
• gopkg.in/natefinch/lumberjack.v2 — access log file rotation
• github.com/prometheus/client_golang v1.23.2 — Prometheus metrics exposition
• github.com/prometheus/client_model v0.6.2 — Prometheus data model
• go.opentelemetry.io/otel v1.41.0 — OpenTelemetry core (traces, metrics, logs)
• go.opentelemetry.io/otel/sdk, sdk/log, sdk/metric — OTel SDK
• go.opentelemetry.io/otel/exporters/otlp/… (7 packages) — OTLP exporters over gRPC and HTTP for traces, metrics, logs
• go.opentelemetry.io/contrib/bridges/otellogrus — bridge logrus → OTel logs
• go.opentelemetry.io/contrib/propagators/autoprop — automatic trace context propagation
• go.opentelemetry.io/collector/pdata — OpenTelemetry collector data types
• github.com/influxdata/influxdb-client-go/v2 — InfluxDB v2 metrics
• github.com/influxdata/influxdb1-client — InfluxDB v1 metrics (legacy)

Service Discovery / Providers#

• github.com/docker/docker v28.5.2, docker/cli, docker/go-connections — Docker provider (label-based service discovery)
• github.com/hashicorp/consul/api v1.26.1 — Consul catalog + KV provider
• github.com/kvtools/valkeyrie v1.0.0 — abstraction layer over KV stores
• github.com/kvtools/consul, etcdv3, redis, zookeeper — KV store backends via valkeyrie
• github.com/hashicorp/nomad/api — Nomad provider
• k8s.io/api, apimachinery, client-go, apiextensions-apiserver v0.35.2 — Kubernetes provider (Ingress + CRD)
• sigs.k8s.io/gateway-api v1.5.1 — Kubernetes Gateway API support
• sigs.k8s.io/controller-runtime v0.23.3 — Kubernetes controller machinery
• knative.dev/networking, knative.dev/pkg — Knative ingress provider
• github.com/aws/aws-sdk-go-v2 + service/ec2, ecs, ssm — AWS ECS provider
• github.com/google/go-github/v28 — GitHub API (used for version checking at startup)
• github.com/coreos/go-systemd/v22 — systemd socket activation and journal logging

TLS / Security#

• github.com/go-acme/lego/v4 v4.33.0 — Let’s Encrypt ACME client (certificate issuance and renewal, DNS/HTTP/TLS challenges). This is the largest transitive tree puller (brings in 50+ DNS provider SDKs as indirect deps).
• github.com/spiffe/go-spiffe/v2 — SPIFFE/SPIRE mTLS identity (workload certificate issuance)
• github.com/tailscale/tscert — Tailscale certificate integration

Plugin / Scripting System#

• github.com/tetratelabs/wazero v1.8.0 — pure-Go WASM runtime (no CGO) for the WASM plugin system
• github.com/http-wasm/http-wasm-host-go v0.7.0 — HTTP middleware ABI over WASM
• github.com/stealthrocket/wasi-go, wazergo — WASI system call support for WASM modules
• github.com/traefik/yaegi v0.16.1 — Go source code interpreter (allows Go plugins loaded at runtime without compilation)
• github.com/yuin/gopher-lua v1.1.1 — Lua scripting engine (used in some internal scripting paths)

Testing#

• github.com/stretchr/testify v1.11.1 — primary assertion library
• github.com/testcontainers/testcontainers-go v0.40.0 — container-based integration tests
• github.com/testcontainers/testcontainers-go/modules/k3s — k3s (lightweight k8s) for Kubernetes integration tests
• github.com/stvp/go-udp-testing — UDP statsd sink for testing metrics
• github.com/pmezard/go-difflib — readable diff output in test failures

Stdlib reliance#

Traefik makes heavy use of stdlib, particularly:

• net/http — core proxy operations, response writers, request handling
• crypto/tls — TLS termination and mTLS; Traefik extends stdlib TLS with custom GetCertificate and GetConfigForClient hooks
• context — pervasive for request lifecycle and cancellation
• net — TCP/UDP listener management, IP parsing
• sync — mutex-protected config stores, sync.Map for provider state
• io — streaming proxy bodies
• time — timeouts, rate limiting, retry backoff

Despite this, Traefik cannot rely on stdlib alone for its core networking features: HTTP/3 requires quic-go, WebSocket upgrading requires gorilla/websocket, and the routing DSL requires vulcand/predicate. The proxy utilities in vulcand/oxy (buffering, streaming, sticky sessions) are also irreplaceable from stdlib alone.

Shared dependencies#

Dependencies that overlap with other projects in the analysis set, creating connection points:

The Kubernetes dependencies (k8s.io/*, sigs.k8s.io/*, knative.dev/*) represent the most distinctive sharing — Traefik is essentially a Kubernetes-native application in v3.

Vendoring#

No vendor directory. Traefik relies on the standard Go module cache. This is a pragmatic choice given the size of the dependency tree (pinning hundreds of packages in vendor would be a maintenance burden). For production deployments, Docker multi-stage builds use the module cache via build layer caching.

Notable: four packages use replace directives to point at Traefik/Containous forks:

• gorilla/mux → containous/mux (custom routing additions)
• vulcand/oxy/v2 → traefik/oxy/v2 (proxy utility improvements)
• abbot/go-http-auth → containous/go-http-auth (security fixes)
• mailgun/minheap → containous/minheap (bug fixes)

One internal module uses replace to point at ./pkg/config/dynamic/ext for the dynamic config extension system — this local replace is the mechanism for the plugin configuration type system.

Notable dependency decisions#

1. lego as the ACME engine is an enormous transitive pull. go-acme/lego/v4 implements automatic TLS for 100+ DNS providers, each with its own cloud SDK as an indirect dependency. This explains why go.sum has ~1017 resolved entries despite only ~118 direct deps. The Azure, AWS, Google Cloud, Alibaba, and dozens of boutique DNS provider SDKs all arrive transitively through lego alone.

2. Two logging libraries coexist. zerolog is the primary structured logger for Traefik’s own code (fast, no allocations). logrus persists because some third-party integrations (OpenTelemetry bridges, some provider libraries) depend on it. The otellogrus bridge allows logrus log events to flow into the OTel pipeline.

3. No Viper. Despite the heavy config complexity, Traefik does NOT use spf13/viper. It uses its own traefik/paerser — extracted from Traefik itself — which provides a unified multi-source config loader tailored to Traefik’s needs. Viper appears only as an indirect dep through unrelated transitive paths.

4. Dual plugin runtimes. Both WASM (wazero + http-wasm-host-go) and pure-Go interpretation (yaegi) are supported as plugin mechanisms. WASM plugins allow arbitrary language plugins with sandboxing; yaegi-based plugins allow Go source plugins deployed without compilation. This unusual dual approach reflects Traefik’s priority on zero-downtime plugin hot-reload.

5. kvtools/* abstraction layer. Instead of depending directly on etcd, ZooKeeper, and Redis clients, Traefik uses the kvtools/valkeyrie abstraction layer with individual backend packages. This keeps the KV-provider code clean and swappable at the cost of adding another dependency layer.

6. Fork maintenance overhead. Four replace directives to Traefik/Containous forks represent a maintenance commitment. The gorilla/mux fork (the router) is the most significant — it means Traefik must track gorilla/mux security patches and backport them manually.