If you have not already read it, maybe you would like to go through the [quick start guide](../../../getting-started/index.md) that uses the Docker provider.

providers:
  swarm: {}

[providers.swarm]

--providers.swarm=true

services:
  my-container:
    deploy:
      labels:
        - traefik.http.routers.my-container.rule=Host(`example.com`)
        - traefik.http.services.my-container-service.loadbalancer.server.port=8080

The docker-compose file shares the docker sock with the Traefik container

```yaml
services:
  traefik:
     image: traefik:v3.1 # The official v3 Traefik docker image
     ports:
       - "80:80"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
```

We specify the docker.sock in traefik's configuration file.

```yaml tab="File (YAML)"
providers:
  swarm:
    endpoint: "unix:///var/run/docker.sock"
     # ...
```

```toml tab="File (TOML)"
[providers.swarm]
  endpoint = "unix:///var/run/docker.sock"
  # ...
```

```bash tab="CLI"
--providers.swarm.endpoint=unix:///var/run/docker.sock
# ...
```

Using Docker 18.09+ you can connect Traefik to daemon using SSH.
We specify the SSH host and user in Traefik's configuration file.
Note that if the server requires public keys for authentication, you must have them accessible for the user running Traefik.

```yaml tab="File (YAML)"
providers:
  swarm:
    endpoint: "ssh://[email protected]:2022"
     # ...
```

```toml tab="File (TOML)"
[providers.swarm]
  endpoint = "ssh://[email protected]:2022"
  # ...
```

```bash tab="CLI"
--providers.swarm.endpoint=ssh://[email protected]:2022
# ...
```

Using Docker Engine API you can connect Traefik to remote daemon using HTTP.

```yaml tab="File (YAML)"
providers:
  swarm:
    endpoint: "http://127.0.0.1:2375"
     # ...
```

```toml tab="Static Configuration (TOML)"
[providers.swarm]
  endpoint = "http://127.0.0.1:2375"
  # ...
```

```bash tab="CLI"
--providers.swarm.endpoint=http://127.0.0.1:2375
# ...
```

Using Docker Engine API you can connect Traefik to remote daemon using TCP.

```yaml tab="File (YAML)"
providers:
  swarm:
    endpoint: "tcp://127.0.0.1:2375"
     # ...
```

```toml tab="File (TOML)"
[providers.swarm]
  endpoint = "tcp://127.0.0.1:2375"
  # ...
```

```bash tab="CLI"
--providers.swarm.endpoint=tcp://127.0.0.1:2375
# ...
```

providers:
  swarm:
    endpoint: "unix:///var/run/docker.sock"

[providers.swarm]
  endpoint = "unix:///var/run/docker.sock"

--providers.swarm.endpoint=unix:///var/run/docker.sock

| port label         | Container's binding                                | Routes to      |
|--------------------|----------------------------------------------------|----------------|
| <a id="opt-row" href="#opt-row" title="#opt-row">-</a> |           -                                        | IntIP:IntPort  |
| <a id="opt-row-2" href="#opt-row-2" title="#opt-row-2">-</a> | ExtPort:IntPort                                    | IntIP:IntPort  |
| <a id="opt-row-3" href="#opt-row-3" title="#opt-row-3">-</a> | ExtIp:ExtPort:IntPort                              | ExtIp:ExtPort  |
| <a id="opt-LblPort" href="#opt-LblPort" title="#opt-LblPort">LblPort</a> |           -                                        | IntIp:LblPort  |
| <a id="opt-LblPort-2" href="#opt-LblPort-2" title="#opt-LblPort-2">LblPort</a> | ExtIp:ExtPort:LblPort                              | ExtIp:ExtPort  |
| <a id="opt-LblPort-3" href="#opt-LblPort-3" title="#opt-LblPort-3">LblPort</a> | ExtIp:ExtPort:OtherPort                            | IntIp:LblPort  |
| <a id="opt-LblPort-4" href="#opt-LblPort-4" title="#opt-LblPort-4">LblPort</a> | ExtIp1:ExtPort1:IntPort1 & ExtIp2:LblPort:IntPort2 | ExtIp2:LblPort |

!!! info ""
    In the above table:

    - `ExtIp` stands for "external IP found in the binding"
    - `IntIp` stands for "internal network container's IP",
    - `ExtPort` stands for "external Port found in the binding"
    - `IntPort` stands for "internal network container's port."

providers:
  swarm:
    useBindPortIP: true
    # ...

[providers.swarm]
  useBindPortIP = true
  # ...

--providers.swarm.useBindPortIP=true
# ...

providers:
  swarm:
    defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
    # ...

[providers.swarm]
  defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
  # ...

--providers.swarm.defaultRule='Host(`{{ .Name }}.{{ index .Labels "customLabel"}}`)'
# ...

The exposure of the Traefik container, combined with the default rule mechanism,
can lead to create a router targeting itself in a loop.
In this case, to prevent an infinite loop,
Traefik adds an internal middleware to refuse the request if it comes from the same router.

Note that `traefik.*` is a reserved label namespace for configuration and can not be used as a key for custom constraints.

```toml
# Includes only containers having a label with key `a.label.name` and value `foo`
constraints = "Label(`a.label.name`, `foo`)"
```

```toml
# Excludes containers having any label with key `a.label.name` and value `foo`
constraints = "!Label(`a.label.name`, `value`)"
```

```toml
# With logical AND.
constraints = "Label(`a.label.name`, `valueA`) && Label(`another.label.name`, `valueB`)"
```

```toml
# With logical OR.
constraints = "Label(`a.label.name`, `valueA`) || Label(`another.label.name`, `valueB`)"
```

```toml
# With logical AND and OR, with precedence set by parentheses.
constraints = "Label(`a.label.name`, `valueA`) && (Label(`another.label.name`, `valueB`) || Label(`yet.another.label.name`, `valueC`))"
```

```toml
# Includes only containers having a label with key `a.label.name` and a value matching the `a.+` regular expression.
constraints = "LabelRegex(`a.label.name`, `a.+`)"
```

providers:
  swarm:
    constraints: "Label(`a.label.name`,`foo`)"
    # ...

[providers.swarm]
  constraints = "Label(`a.label.name`,`foo`)"
  # ...

--providers.swarm.constraints=Label(`a.label.name`,`foo`)
# ...

Please note that any tool like Nomad, Terraform, Ansible, etc.
that is able to define a Docker container with labels can work
with Traefik and the  Swarm provider.

docker service create \
  --constraint=node.role==manager \
  #... \

services:
  traefik:
    # ...
    deploy:
      placement:
        constraints:
          - node.role == manager

[...] only **trusted** users should be allowed to control your Docker daemon [...]