November 2026’s Traefik 3.3 surge: myths vs facts for platform teams

The Ingress NGINX retirement

The Ingress NGINX project maintainers announced the retirement of the Ingress NGINX Controller on November 12, 2025. This retirement happens in March 2026, leaving organizations with a 120-day window to move workloads away from unmaintained software. If you run production workloads on Ingress NGINX after March 2026, you run unmaintained software with vulnerabilities like the #IngressNightmare configuration injection attacks. While F5 NGINX Ingress or cloud provider solutions like AWS and AKS require you to rewrite every custom annotation or rebuild your ingress layer from scratch, Traefik has an NGINX Provider that handles most used nginx.ingress.kubernetes.io annotations natively. This compatibility means your Ingress objects work without changes. You can perform a progressive migration by deploying Traefik in ClusterIP mode alongside your existing Ingress NGINX setup. Check that routing works with a port-forwarding test before you remove the Ingress NGINX deployment and update the Traefik deployment to a LoadBalancer service type. You must also update your DNS records and check that Traefik serves your untouched ingress resources. A prudent strategy separates the immediate decommissioning of Ingress NGINX from the long-term goal of Gateway API modernization. You should address the immediate crisis of the deprecation deadline first, then plan your Gateway API adoption on your own timeline. While Traefik v3.6 has full v1.4 support for the Gateway API, you do not need to migrate all your ingress resources to Gateway resources like HTTPRoute or TLSRoute under deadline pressure.

Performance and memory realities

I find that choosing a proxy involves weighing specific architectural trade-offs against your existing skill sets. You already know how a reverse proxy functions, so I will skip the basics of header manipulation. NGINX remains the gold standard for raw throughput and ultra-low CPU utilization under hundreds of thousands of concurrent connections. Use NGINX if you need extreme caching customization or legacy system integration. Traefik excels in dynamic container environments like Docker and Kubernetes because it updates routing rules without configuration reloads. However, I noticed a report where a user running Traefik v2.5.4 on a Kubernetes cluster saw a ten times performance drop when routing traffic through Traefik for docker pushes to a Harbor registry. In that test, the user ran wrk with 20 threads and 1000 connections for 60 seconds. The user saw internal cluster IP speeds of 16 to 17 MB/s, but performance declined to 13 MB/s when using Traefik. Users also reported memory issues, such as a 2022 GitHub issue where Traefik v2.8.1 pods on GKE showed continuous memory increases. In one instance, a Grafana dashboard showed Traefik instances in Docker Swarm using 5GB of RAM, although htop and docker stats showed normal usage. One user noted that the container_memory_usage_bytes metric includes cached items that the OOM killer ignores. They suggested container_memory_working_set_bytes is a better metric. To address such issues, developers suggest enabling the pprof API endpoint or providing a minimal reproducible case. A fix for the retry middleware was released in version 2.8.4 to prevent indefinite retries when a panic occurs. Caddy gives automatic, zero-configuration HTTPS with Let’s Encrypt and native HTTP/3 QUIC support. It works well for internal developer tools or staging environments where rapid prototyping is the goal. I advise against using Caddy if you need high-performance Brotli encoding on a single-core machine because the pure-Go library is slow.

Comparing the market landscape

Scale of adoption varies significantly across these three tools. NGINX works for over 400 million websites globally and has 45,000 to 50,000 job postings. Traefik has more than 3 billion pulls on Docker Hub, 58,000 GitHub stars, and 500 to 800 job postings. Caddy has 200 to 300 job postings and 1,800 Stack Overflow questions. Companies like Netflix, Airbnb, Dropbox, and Microsoft Azure use NGINX, while companies like GitLab, Red Hat, and DigitalOcean use Traefik. Caddy is maintained by ZeroSSL with Matt Holt as the primary creator and a community of 10 to 15 core contributors. Traefik is maintained by Traefik Labs with a core team of 10 to 15 maintainers. NGINX is maintained by F5 Networks with a core team of approximately 15 to 20 full-time engineers.

I recommend migrating to Traefik if you need to escape the Ingress NGINX retirement deadline without rewriting your entire configuration. Traefik’s NGINX Provider addresses 80% of real-world usage patterns. NGINX has a moderate learning curve and uses a freemium pricing model starting at $0. Traefik has a moderate learning curve and uses a freemium pricing model with Enterprise options available via contact. Both NGINX and Traefik support SOC 2, GDPR, HIPAA, and PCI-DSS. Does the current memory stability of Traefik satisfy your long-term production needs?