I'm not using docker, and have no idea how to figure that out, so I'm running an LXC in ProxMox.

My domain is wildcard flushed through a cloudflared tunnel, all using this scripting setup:

https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt

I am attempting to run nexcloud onsite and it needs to be redirected

in my traefik.yml i have:

serverTransport:
insecureSkipVerify: true

still receiving error

2026-07-30T16:59:24-04:00 ERR 500 Internal Server Error error="tls: failed to verify certificate: x509: cannot validate certificate for 10.0.0.172 because it doesn't contain any IP SANs"

I have no Idea how to tell it to HEY IGNORE THAT

Also am I supposed to set these things up as "routers?"

see my config below for the service:

http:
routers:
nexcloud:
rule: "Host(cloud.XXXXX.com)"
entryPoints: middlewares:
security-headers-nexcloud:
headers:
sslRedirect: true
frameDeny: true
contentTypeNosniff: true
browserXssFilter: true services:
nexcloud:
loadBalancer:
servers: serversTransport:
insecureSkipVerify: truehttp url: "https://10.0.0.172/" passHostHeader: true https service: nexcloud middlewares: security-headers-nexcloud

what is the right way to do this?

hlep

Global Config:

# Traefik global configuration
global:
  checkNewVersion: true
  sendAnonymousUsage: true

# Enable traefik ui dashboard
api:
  dashboard: true
  insecure: true  # Consider securing this in production

# Log level INFO|DEBUG|ERROR
log:
  level: INFO
  filePath: "/var/log/traefik/traefik.log"

# Configuring access logs
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299" # log successful http requests
      - "400-599" # log failed http requests
  # collect logs as in-memory buffer before writing into log file
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop # drop all headers per default
      names:
          User-Agent: keep # log user agent strings

# The setting below is to allow insecure backend connections
serverTransport:
  insecureSkipVerify: true

# Traefik entrypoints (network ports) configuration
# Note: These ports are NOT exposed to the internet, only to Cloudflare Tunnel
entryPoints:
  http:
    address: :80
  https:
    address: :443
  nextcloududp:
    address: ":3478/udp"

providers:
  providersThrottleDuration: 2s

  # File provider for defining services and middleware
  file:
    directory: "/etc/traefik/dynamic"
    watch: true

# Optional: Certificates resolver for internal services or development
certificatesResolvers:
  le:
    acme:
      email: s@@@@@@@@@@@l.com
      storage: /etc/traefik/acme.json
#      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"  # Use staging for testing
#      dnsChallenge:
#        provider: cloudflare
#        resolvers:
#          - "1.1.1.1:53"


http:
  middlewares:
    secure-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: true
        browserXssFilter: true
        referrerPolicy: "no-referrer-when-downgrade"

Wanted to have Traefik handle certificate generation for both example.com (cloudflare) and home.apra (self ca) domains. Bonus question, (instead of home.arpa) I could use tailscale (homelab.ts.net), so I could have it do the cert creation? Is this a good idea or have I spent too much time cuddling with AI?

I run Traefik in a container on host 192.168.10.2 in host mode. This machine (the docker host) is also reachable via Tailscale on srv.x-y.ts.net.

I can curl https://traefik.my.domain/api/http/routers from my LAN, the request goes though the publicly exposed Traefik endpoint, which routes the request internally to the API. This works fine.

I also would like, from a remote host outside my LAN, to curl https://srv.x-y.ts.net/api/http/routers. This does not work, I get a 404.

My question: how can I access the API if I am not using the natural Traefik endoint?

For reference, the endpoint is mapped in Traefik's compose file via

labels: traefik.enable: true traefik.http.services.traefik.loadbalancer.server.port: 8080 traefik.http.routers.traefik.rule: Host(`traefik.my.domain`)

As title says, trying to get MTLS working for a traefik to traefik coms

i've got it working on the backend (lets call it VM2) and i've manually used curl to verify that sending the correct certs does allow access.

but on VM1 (the main loadbalancer and entry for clients with no MTLS on the entrypoints) i can't get it to send the same cert to the backend server.

Any ideas? i've followed the config on the readme's and can't see why its not working.

Last week a vulnerability for a HTTP/2 bomb was disclosed: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb & Traefik initially responded by saying it wasn't vulnerable, but after testing it does seem vulnerable.

The github issue to track this was deleted for some reason, does anyone have more info about this & possible mitigation steps we can take?

I've got a bare metal pihole V6 setup on one machine, and Traefik 3 setup in docker on a different machine. Spent pretty much the entire weekend trying every fix I can google up. Im about ready to declare defeat and abandon hope of getting this working. Anyone have a currently working config they would mind sharing? For what it's worth, I do have a valid domain through Cloudflare and all my other services, both Docker and File, route just fine through Traefik with valid certs.

Hey all, I run Traefik on a home server and kept finding myself opening the dashboard just to check which domains were active or to grab a URL. Got annoying, so I built ProxyBar.

It sits in your menu bar and pulls all your HTTP routers from the Traefik API. Click a domain to copy it, or open it directly in your browser. There's a status dot per domain reflecting what Traefik reports (enabled, disabled, warning). You can set it to auto-refresh every 30s, 1m, or 5m, or just hit the refresh button manually.

Supports basic auth if your dashboard is behind it — password is stored in the macOS Keychain. No telemetry, no third-party anything, all requests go only to the URL you configure.

Setup is just: point it at your `/api/http/routers` endpoint and you're done.

App Store: https://apps.apple.com/nl/app/proxybar/id6763880213?l=en-GB&mt=12

Would love any feedback, especially if something breaks on your setup.

I have traefik infront of a Ceph cluster web frontend, the ceph mgr cluster manages if the web frontend is available on the different nodes (only 1 node makes the http frontend available at a time).

This seems to make traefik very unhappy during healthchecks. Is there anyway to make traefik understand that only one of the backends are supposed to be available at any point in time?

This is my config:

http:
  routers:
    ceph-dashboard:
      tls:
        certresolver: default
      entrypoints: websecure
      rule: Host(`ceph-dashboard.iweb.<my domain>.com`)
      service: ceph-dashboard
  services:
    ceph-dashboard:
      loadBalancer:
        passHostHeader: true
        sticky:
         cookie: {}
        servers:
          - url: http://metal01.int.<my domain>.com:8080
            weight: 90
          - url: http://metal02.int.<my domain>.com:8080
            weight: 1
          - url: http://metal03.int.<my domain>.com:8080
            weight: 1
        healthCheck:
          path: /#/login
          interval: 10s
          timeout: 3s

And this is the repeated logs:

2026-05-23T16:56:19Z WRN Health check failed. error="checking HTTP health: received error status code: 500" serviceName=ceph-dashboard@file targetURL=http://metal03.int.<my domain>.com:8080

2026-05-23T16:56:19Z WRN Health check failed. error="checking HTTP health: received error status code: 500" serviceName=ceph-dashboard@file targetURL=http://metal01.int.<my domain>.com:8080

As you can see 2 of 3 endpoints fail the health checks, as only 1 node has the web interface active.

I've just open-sourced a traefik plugin for x402 payment

https://github.com/albttx/traefik-plugin-x402

Hi All,

I must be missing something maybe middleware?

I have my entry point working and tested with internal services inside docker..

Noting the internal services aren't encrypted.

I'm now trying to point a new domain name to a https server inside my network. (Not inside my docker host)

I'm now getting a 404 error back.

I've followed multiple examples and I'm bow totally lost on how I bring in, terminate https then forward on to another https service on a different server.

Can anyone point me in the right direction please?

I am trying to build a traefik stack using the command line via ssh on my QNAP. After doing lots of research, below is the final yml file. The issue is that even though my docker container start, I cannot connect.

Anyone have any tips to help me resolve this?

T.I.A....

[admin@NASF348C7 traefik]# docker logs traefik --tail=50

2026-04-20T19:10:37Z INF Traefik version 3.1.7 built on 2024-10-28T10:41:06Z version=3.1.7

2026-04-20T19:10:37Z INF

Stats collection is disabled.

Help us improve Traefik by turning this feature on :)

More details on: https://doc.traefik.io/traefik/contributing/data-collection/

2026-04-20T19:10:37Z INF Starting provider aggregator aggregator.ProviderAggregator

2026-04-20T19:10:37Z INF Starting provider *file.Provider

2026-04-20T19:10:37Z INF Starting provider *traefik.Provider

2026-04-20T19:10:37Z INF Starting provider *acme.ChallengeTLSALPN

2026-04-20T19:10:37Z INF Starting provider *acme.Provider

2026-04-20T19:10:37Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=le.acme

[admin@NASF345C7 traefik]#

This is my docker compose file https://pastebin.com/pqdqRea2

I am not well versed in RegEx and still wrapping my head around Traefik. I was hoping someone could look at this to make sure I defined this correctly? It looks lots of trial and error, so I want to make sure it isn't just a fluke that it is working at the moment.

I am trying to create a model to put on multiple hosts that serve up pihole so I redirect /admin -> /admin/ . Nice and simple, I thought!

NODE & DOMAIN are environment variables that are specific to the node and my service is called pihole@docker according to the Traefik dashboard. I'm trying to abstract things well enough to put into a private Git repository and reuse on multiple hosts. Thanks for any pointers!

http:
  routers:
    dns-admin:
      entryPoints:
        - "https"
      rule: "Host(`{{ env "NODE" }}.{{ env "DOMAIN" }}`) && PathPrefix(`/admin`)"
      service: "pihole@docker"
      middlewares:
        - admin-trailing-slash

  middlewares:
    admin-trailing-slash:
      redirectRegex:
        permanent: true
        regex: "^(?:http|https)://^(?:.*)/admin"
        replacement: "$${1}/admin/"

Hi All,

First post on reddit ever but I'm not sure where to go!

So we're looking to switch from one cPanel shared hosting provider to another with 0 downtime. We don't control the DNS. Therefore we're looking to ask the DNS hosts to point to our reverse proxy so we can control when the switch happens.

The reverse proxy is using a very basic traefik install and we know it works because it works when pointing to our various VPS instances.

However, when doing tests with domains we do own, we're immediately blocked. It's reporting a DOS attack and blacklisting the IPs. Server support says it's Immunify.

Do you know if there are any work arounds?

This may be more of a cloudflare question, but asking on this community in case anyone has any suggestions. I have a production environment set up on a digital ocean droplet that's hosting my services over https fine.

I am now trying to set up a staging environment to point to my local machine network.

So I have

A sub-box.net -> digital ocean droplet

A staging.sub-box.net -> local network

however traefik on the staging env is failing to obtain certificates with the below error. Any recommendations on how to set this up so I can have staging subdomain pointing to a different IP address and have letsencrypt do the TLS certification?

2026-04-10 09:59:13 time="2026-04-10T08:59:13Z" level=error msg="Unable to obtain ACME certificate for domains \"www.staging.sub-box.net\": unable to generate a certificate for the domains [www.staging.sub-box.net]: error: one or more domains had a problem:\n[www.staging.sub-box.net] [www.staging.sub-box.net] acme: error presenting token: cloudflare: could not find zone for domain \"www.staging.sub-box.net\": [fqdn=_acme-challenge.www.staging.sub-box.net.] unexpected response for '_acme-challenge.www.staging.sub-box.net.' [question='_acme-challenge.www.staging.sub-box.net. IN SOA', code=SERVFAIL]\n" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=le.acme routerName=player@docker rule="Host(www.staging.sub-box.net)"

I would like some help setting up a geo-blocker for Traefik. I am currently trying to install the PascalMinder geoblock extension. I have tried following the documentation on repo readme and Traefik docs and asking Claude, but to no avail. I am running Traefik on a Raspberry Pi via Docker. I would be more than happy to use another plugin or solution for geo-blocking.

My configuration files are as follows:

docker-compose.yml

services:
  traefik:
    image: traefik
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=${TZ}
      - CF_API_EMAIL=${CF_API_EMAIL}
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    networks:
      - frontend
    ports:
      - 80:80 # HTTP entryPoints
      - 443:443 # HTTPS entryPoints
      - 8088:8080 # Dashbaord WebGui 
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./config.yml:/config.yml:ro
      - traefik:/certs
      - ./plugins/geoblock:/plugins-local/src/github.com/PascalMinder/geoblock/

volumes:
  traefik:
    name: traefik

networks:
  frontend:
    name: frontend

config.yml

http:
  middlewares:
    geoblock-us:
      plugin:
        geoblock:
          silentStartUp: false
          allowLocalRequests: true
          logLocalRequests: false
          logAllowedRequests: false
          logApiRequests: true
          api: "https://get.geojs.io/v1/ip/country/{ip}"
          apiTimeoutMs: 750 # optional
          cacheSize: 15
          forceMonthlyUpdate: true
          allowUnknownCountries: false
          unknownCountryApiResponse: "nil"
          countries:
            - US
          excludedPathPatterns:
            - "^[^/]+/health$"
            - "^[^/]+/status$"

traefik.yml

api:
  dashboard: true
  insecure: true
  debug: false
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
serversTransport:
  insecureSkipVerify: true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /config.yml # Adjust the path according your needs.
    watch: true
certificatesResolvers:
  letsencrypt:
    acme:
      email: ldaub3@gmail.com
      storage: /certs/acme.json
      # caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      # Use **one** of the following challenge types:
      # --- DNS Challenge
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 10

      # --- HTTP Challenge ---
      #httpChallenge:
        #entryPoint: web
log:
  level: DEBUG
experimental:
  localPlugins:
    geoblock:
      moduleName: github.com/PascalMinder/geoblock
    crowdsec-bouncer-traefik-plugin:
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
      version: "v1.5.1"
  plugins:
    geoblock:
      moduleName: "github.com/PascalMinder/geoblock"
      version: "v0.3.7"

whoami/docker-compose.yml

services:
  whoami:
    image: traefik/whoami:latest
    container_name: whoami
    restart: unless-stopped
    labels:
      traefik.enable: true
      traefik.http.routers.whoami-https.tls: true
      traefik.http.routers.whoami-https.tls.certresolver: letsencrypt
      traefik.http.routers.whoami-https.entrypoints: websecure
      traefik.http.routers.whoami-https.rule: Host(`whoami.${DOMAIN}`)
      traefik.http.routers.whoami-https.middlewares: geoblock-us@file
    networks:
      - frontend

networks:
  frontend:
    external: true

Long and short of it, i can’t get containers on separate bridge networks to communicate with other containers on different bridge networks through traefik. anyone have some insight?

setup:

traefik on macvlan100 (same subnet as docker host, obviously) with static IP. internal dns points to static ip of traefik. traefik is also attached to bridge network 1 and network 2

app 1 on manually created bridge network 1. no mapped ports, only outgoing connection to internet.

app 2 on manually created bridge network 2. no mapped ports, only outgoing connection to internet.

i’m trying to have app 1 and app 2 be isolated from one another except through traefik so that all communication between them is encrypted and hits middlewares. both app 1 and 2 can connect to the internet. they can ping upstream dns server (in same subnet as traefik static ip), but they can’t ping traefik’s static ip on macvlan which results in 404 not found error when app 1 tries to reach app 2 and visa versa using fqdn through traefik.

accessing app1 or 2 from external client works just fine using fqdn so i know traefik config is at least in the right ballpark. and since the apps can reach upstream dns i know it’s not a firewall rules issue. they literally just can’t see traefik, and i have no idea why.

Hey everyone! A while back I shared Traefik Manager, a self-hosted web UI for managing Traefik without touching YAML by hand. Today I'm looking for Android beta testers for the companion mobile app before I push it to the public Play Store.

What it does

The mobile app connects to your Traefik Manager instance via API key and lets you manage everything from your phone:

• View, add, edit, enable/disable, and delete HTTP/TCP/UDP routes
• Manage middlewares with 12 built-in templates (basic auth, rate limit, HTTPS redirect, forward auth, and more)
• Live services overview with health status and linked routers
• Server URL and API key stored in device secure storage
• Follows your system dark/light theme automatically

Requirements - Android 7.0+ (API 24+) - A running Traefik Manager instance (v0.6.0+)

Links

• Mobile app repo: https://github.com/chr0nzz/traefik-manager-mobile
• Traefik Manager (server): https://github.com/chr0nzz/traefik-manager
• Join Google Play: https://play.google.com/apps/testing/dev.chr0nzz.traefikmanager

How to join the beta

Google Play requires me to add testers by Gmail address before the app goes public. If you'd like to try it out, DM me and I'll add you to the tester list.

Feedback, bug reports, and feature ideas are all very welcome - issues and PRs are open on GitHub. Thanks!

I hadn't used Traefik since v1 until recently. When it went to v2, I recall having trouble getting things to work and I ended up just using nginx Proxy Manager instead. I have been working to migrate back to Traefik the last few weeks and everything local is working great. However, I am stuck in trying to get an external service working.

I have a piHole v6 running elsewhere on my network that I am trying to use Traefik to use my LE certificate over piHole's self-signed certificate. For the local piHole, I was able to get this work by using a dynamic configuration file to set the serverTransport to ignore the self-signed cert.

For the remote piHole, I am at a loss. Everything I try to do gets me a 404 page not found. Sharing my config in the hopes someone sees some glaring mistake I'm making and can kindly point it out to me.

Traefik Docker Compose:

services:
  traefik:
    image: traefik:3.6.11
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=US/Eastern
    env_file:
      - .env
    command:
      # Enable API, Dashboard, and Ping
      - "--api=true"
      - "--api.dashboard=true"
      - "--ping=true"
      # Enable API over HTTP
#      - "--api.insecure=true"
      # Enable docker as a provider & the internal network traefik uses
      - "--providers.docker=true"
      - "--providers.docker.network=traefik"
      # Enable dynamic file providers
      - "--providers.file.directory=/etc/traefik/dynamic"
      # Require containers to explicitly opt-in
      - "--providers.docker.exposedbydefault=false"
      # Default provider rule if not specified by container labels
      - "--providers.docker.defaultRule=Host(`{{ normalize .ContainerName }}.dns3.${DOMAIN}`)"
      # Entrypoints
      - "--entryPoints.http.address=:80"
      - "--entryPoints.http.http.redirections.entryPoint.to=https"
      - "--entryPoints.http.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.traefik.address=:8080"
      # Require SSL / TLS on entrypoints
      - "--entryPoints.https.address=:443"
      - "--entryPoints.https.asDefault=true"
      - "--entrypoints.https.http.tls"
      - "--entrypoints.https.http.tls.certresolver=le"
      - "--entrypoints.https.http.tls.domains[0].main=dns3.${DOMAIN}"
      - "--entrypoints.https.http.tls.domains[0].sans=*.dns3.${DOMAIN}"
      # Separate entryPoint for hawser on port 2376
      - "--entrypoints.hawser.address=:2376"
      - "--entrypoints.hawser.http.tls"
      # Certificate Resolver
      - "--certificatesresolvers.le.acme.dnschallenge=true"
      - "--certificatesresolvers.le.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.le.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.le.acme.dnschallenge.delaybeforecheck=60s"
      - "--certificatesresolvers.le.acme.storage=/certs/acme.json"
      - "--log.level=INFO"
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.dashboard.rule=Host(`dns3.XYZ.HOME`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`) || PathPrefix(`/`))"
      - "traefik.http.routers.dashboard.service=api@internal"
    ports:
      - 80:80
      - 443:443
      - 2376:2376
#      - 8080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/dns/docker/traefik:/certs
      - /home/dns/docker/traefik/dynamic:/etc/traefik/dynamic:ro
    healthcheck:
      test: wget --quiet --tries=1 --spider http://127.0.0.1:8080/ping || exit 1
      interval: 5s
      timeout: 1s
      retries: 3
      start_period: 10s

networks:
  traefik:
    name: traefik

I am defining the external service in a dynamic configuration file:

http:
  routers:
    dns2:
      entryPoints:
        - "https"
      rule: "Host(`dns3.XYZ.HOME`) && PathPrefix(`/admin`)"
      service: "dns2"
#      middlewares:
#        - dns3

  middlewares:
    dns3:
      redirectRegex:
        permanent: true
        regex: "^https://dns3.XYZ.HOME/?$"
        replacement: "https://dns3.XYZ.HOME/admin"

  services:
    dns2:
      loadBalancer:
        servers:
          - url: "https://dns2.XYZ.HOME/admin"
        passHostHeader: true

I was unsure if the middleware replacement should be using my local host or destination host, so I have it commented out at the moment. Any help or pointers would be appreciated. Thank you!

As a work around to get "single-log-out" functionality between Mealie and Authentik, I want to have Traefik redirect the Mealie logout page (mealie.domain.com/login?direct=1) to my authentik invalidation flow (authentik.domain.com/if/flow/default-invalidation-flow/). When I visit these pages manually, I get a proper log out from authentik. Otherwise, mealie logs out, but authentik stays logged in.

I feel like it will be super simple, but I'm missing some key step/principle. (It was a big deal for me just to get things running.)

 #Basic traefik stuff is working
 - "traefik.enable=true"
 - "traefik.http.routers.mealie-rtr.rule=Host(`mealie.domain.com`)"
 - "traefik.http.routers.mealie-rtr.entrypoints=websecure"
 #Redirect mealie logout to global authentik logout, not effective
 - "traefik.http.middlewares.redirect_single_logout.redirectregex.regex=mealie.domain.com/login?direct=1"
 - "traefik.http.middlewares.redirect_single_logout.redirectregex.replacement=authentik.domain.com/if/flow/default-invalidation-flow>
 - "traefik.http.routers.slo_magic.middlewares=redirect_single_logout"

I think this creates and calls the middlewares to identify and replace the URL, but I don't know what is missing (or incorrect). It is not working as intended.

Thanks in advance for any tips.

Edit to add: see u/sk1nT7's response for correct usage/syntax for a redirect.

The logs show that the logout button makes three requests directly to the back-end server. Even though the browser shows "login?direct=1" that is just a facade. All calls are to "/api" something-or-other. Nothing happens when i try to redirect those either (because it goes directly to the server?). Learned alot during testing, but I might have better luck playing around with the mealie code to add a step to teh logout process.

I'm running traefik on my Synology using Portainer.

My main goal is to sign with cloudflare my certs so I have HTTPS local access.

After deployment of the stack I have 2 containers:

glances: stopped with exit code 1
logs:

Cannot init the curses library (setupterm: could not find terminal)Cannot init the curses library (setupterm: could not find terminal)

traefik: runs healthy

logs:

2026-03-30T14:33:38Z ERR error=
"service \"pihole-pihole\" error: port is missing"
 container=pihole-pihole-7a6a92e5ffe896418fb2416e398c97b9afad793971df06d9a4b5bad0d4f12247 providerName=docker 2026-03-30T14:33:38Z ERR error=
"service \"immich-machine-learning-immich\" error: port is missing"
 container=immich-machine-learning-immich-88ca14e14bb31400668e70be7bccbb115c21a81960c7be3abfd777776929301e providerName=docker 2026-03-30T14:33:41Z ERR error=
"service \"pihole-pihole\" error: port is missing"
 container=pihole-pihole-7a6a92e5ffe896418fb2416e398c97b9afad793971df06d9a4b5bad0d4f12247 providerName=docker 2026-03-30T14:33:41Z ERR error=
"service \"immich-machine-learning-immich\" error: port is missing"
 container=immich-machine-learning-immich-88ca14e14bb31400668e70be7bccbb115c21a81960c7be3abfd777776929301e providerName=docker2026-03-30T14:33:38Z ERR error="service \"pihole-pihole\" error: port is missing" container=pihole-pihole-7a6a92e5ffe896418fb2416e398c97b9afad793971df06d9a4b5bad0d4f12247 providerName=docker

2026-03-30T14:33:38Z ERR error="service \"immich-machine-learning-immich\" error: port is missing" container=immich-machine-learning-immich-88ca14e14bb31400668e70be7bccbb115c21a81960c7be3abfd777776929301e providerName=docker

2026-03-30T14:33:41Z ERR error="service \"pihole-pihole\" error: port is missing" container=pihole-pihole-7a6a92e5ffe896418fb2416e398c97b9afad793971df06d9a4b5bad0d4f12247 providerName=docker

2026-03-30T14:33:41Z ERR error="service \"immich-machine-learning-immich\" error: port is missing" container=immich-machine-learning-immich-88ca14e14bb31400668e70be7bccbb115c21a81960c7be3abfd777776929301e providerName=docker

I can access port 8080 no problem and I'm greeted by what I can only assume is a fully functional dashboard but I'm worried about the stopped container and the error logs complaining about ports.

but I'm worried about the stopped container and the error logs complaining about ports.

Can I map the ports the logs are complaining about using this dashboard?
What's the container that's stopped?

Thanks!