Web / Traefik Interview questions
Why does Traefik require the exposedByDefault setting to be handled carefully in Docker?
exposedByDefault controls whether every running container is automatically exposed through Traefik, or whether containers must explicitly opt in with traefik.enable=true.
With the default of true, any container on a network Traefik watches becomes reachable the moment it starts, which is convenient in a small demo but risky in a shared environment, since an internal-only service (a database admin panel, for instance) could be exposed to the internet by accident.
Setting exposedByDefault: false flips this to opt-in, requiring the explicit label on every container that should be routable, which is the safer default for anything beyond local experimentation.
Most production setups pair the opt-in flag with a dedicated, restricted Docker network for Traefik to watch, so even a container that forgets the label is never one accidental misconfiguration away from being publicly reachable.
More Related questions...
