We recommend to *not* use labels to store sensitive data (certificates, credentials, etc).
Instead, we recommend to store sensitive data in a safer storage (secrets, file, etc).

Enabling the docker provider (Swarm Mode)

```yaml tab="Structured (YAML)"
providers:
  swarm:
    # swarm classic (1.12-)
    # endpoint: "tcp://127.0.0.1:2375"
    # docker swarm mode (1.12+)
    endpoint: "tcp://127.0.0.1:2377"
```

```toml tab="Structured (TOML)"
[providers.swarm]
  # swarm classic (1.12-)
  # endpoint = "tcp://127.0.0.1:2375"
  # docker swarm mode (1.12+)
  endpoint = "tcp://127.0.0.1:2377"
```

```bash tab="CLI"
# swarm classic (1.12-)
# --providers.swarm.endpoint=tcp://127.0.0.1:2375
# docker swarm mode (1.12+)
--providers.swarm.endpoint=tcp://127.0.0.1:2377
```

Attach labels to services (not containers) while in Swarm mode (in your Docker compose file).
When there is only one service, and the router does not specify a service,
then that service is automatically assigned to the router.

```yaml
services:
  my-container:
    deploy:
      labels:
        - traefik.http.routers.my-container.rule=Host(`example.com`)
        - traefik.http.services.my-container-service.loadbalancer.server.port=8080
```

!!! important "Labels in Docker Swarm Mode"
    While in Swarm Mode, Traefik uses labels found on services, not on individual containers.
    Therefore, if you use a compose file with Swarm Mode, labels should be defined in the `deploy` part of your service.
    This behavior is only enabled for docker-compose version 3+ ([Compose file reference](https://docs.docker.com/compose/compose-file/compose-file-v3/#labels-1)).

Forward requests for `http://example.com` to `http://<private IP of container>:12345`:

```yaml
services:
  my-container:
    # ...
    deploy:
      labels:
        - traefik.http.routers.my-container.rule=Host(`example.com`)
        - traefik.http.routers.my-container.service=my-service"
        # Tell Traefik to use the port 12345 to connect to `my-container`
        - traefik.http.services.my-service.loadbalancer.server.port=12345
```

!!! important "Traefik Connecting to the Wrong Port: `HTTP/502 Gateway Error`"
    By default, Traefik uses the lowest exposed port of a container as detailed in
    [Port Detection](../../install-configuration/providers/swarm.md#port-detection) of the Swarm provider.

    Setting the label `traefik.http.services.xxx.loadbalancer.server.port`
    overrides this behavior.

Forwarding requests to more than one port on a container requires referencing the service loadbalancer port definition using the service parameter on the router.

In this example, requests are forwarded for `http://example-a.com` to `http://<private IP of container>:8000` in addition to `http://example-b.com` forwarding to `http://<private IP of container>:9000`:

```yaml
services:
  my-container:
    # ...
    deploy:
      labels:
        - traefik.http.routers.www-router.rule=Host(`example-a.com`)
        - traefik.http.routers.www-router.service=www-service
        - traefik.http.services.www-service.loadbalancer.server.port=8000
        - traefik.http.routers.admin-router.rule=Host(`example-b.com`)
        - traefik.http.routers.admin-router.service=admin-service
        - traefik.http.services.admin-service.loadbalancer.server.port=9000
```

 Labels are case-insensitive.

To learn how to configure Traefik default generated certificate, refer to the [TLS Certificates](../http/tls/tls-certificates.md#acme-default-certificate) page.

With labels in a compose file

```yaml
labels:
  - "traefik.http.routers.myproxy.rule=Host(`example.net`)"
  # service myservice gets automatically assigned to router myproxy
  - "traefik.http.services.myservice.loadbalancer.server.port=8080"
```

With labels in a compose file

```yaml
labels:
  # no service specified or defined and yet one gets automatically created
  # and assigned to router myproxy.
  - "traefik.http.routers.myproxy.rule=Host(`example.net`)"
```

```yaml
services:
  my-container:
    # ...
    deploy:
    labels:
      # Declaring a middleware
      - traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
      # Referencing a middleware
      - traefik.http.routers.my-container.middlewares=my-redirect
```

If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.

```yaml
services:
  my-container:
    # ...
    deploy:
      labels:
        - "traefik.tcp.routers.my-router.rule=HostSNI(`example.com`)"
        - "traefik.tcp.routers.my-router.tls=true"
        - "traefik.tcp.services.my-service.loadbalancer.server.port=4123"
```

If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined).
You can declare both a TCP Router/Service and an HTTP Router/Service for the same container (but you have to do so manually).

```yaml
# ...
# Declaring a middleware
traefik.tcp.middlewares.test-inflightconn.amount=10
# Referencing a middleware
traefik.tcp.routers.my-service.middlewares=test-inflightconn
```

If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.

```yaml
services:
  my-container:
    # ...
    deploy:
      labels:
        - "traefik.udp.routers.my-router.entrypoints=udp"
        - "traefik.udp.services.my-service.loadbalancer.server.port=4123"
```

If you declare a UDP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no UDP Router/Service is defined).
You can declare both a UDP Router/Service and an HTTP Router/Service for the same container (but you have to do so manually).