Traefik Labs

Yesterday, we shipped the most hardened gateway image ever created. Really.   It's called Distro Zero: a memory-safe, hardened image with no third-party executable content, no shared objects, no libc, no dynamic linker, no shell, and no package manager.   Think of it like a distroless hardened image but far more secure.   🤔 How Is It Different From Traditional Distroless Images? - Zero third-party executables. Just a single memory-safe Go binary - No shell, libc, shared libraries, package manager, or OpenSSL - FIPS 140-3 implemented inside the binary 🎉 - Built for air-gapped and regulated environments - One binary for seamless upgrades to API Gateway, AI Gateway, MCP Gateway, and API Management. No migration necessary. 🤔 Why Now? With record CVEs (~36k so far in 2026), the EU Cyber Resilience Act, and the FIPS 140-2 sunset approaching, now is the time to go Distro Zero.   Learn more about the Traefik Distro Zero Hardened Image here 👇 - Overview: https://bit.ly/4yV7yJe - Full Announcement: https://bit.ly/3S22G4h

🚀 Today we are announcing what we believe is the most hardened and unified gateway image ever built. Count the executables inside it. One. Introducing 𝗗𝗶𝘀𝘁𝗿𝗼 𝗭𝗲𝗿𝗼: a Traefik container image with zero third-party executable content. No libc. No dynamic linker. No system cryptographic library. No shell. No package manager. Nothing a distribution would supply. One static, memory-safe Go binary that we wrote, plus a few files of inert data. Distroless means less. Zero means done. Why now 👇 📈 35,364 CVEs were published in the first half of 2026. One every 7.4 minutes. Nobody out-patches that curve. You shrink what has to be patched. 🧱 40+ CVEs in system OpenSSL since January 2025, plus a dozen in glibc. Not one of them ever applied to our image, because there is no substrate to patch. 🔐 FIPS 140-3 lives inside the binary (CMVP #5247), enforced at the application layer after an audit of the entire codebase. The FIPS boundary and the memory-safe boundary are the same boundary. 🔓 One binary, proxy to platform. Run it as a drop-in reverse proxy, then unlock API Gateway, AI Gateway, MCP Gateway and API Management by license. No new artifact, no migration, no re-validation. 🚨 September 11: EU CRA reporting obligations begin.  🚨September 21: FIPS 140-2 certificates go historical. Neither date moves. Anyone can strip an image. Only the author can stand behind what remains. We chose memory-safe Go in the first commit, ten years ago, and that is the decision that makes zero possible today. 👉 Read the full press release here: https://lnkd.in/gEBrSmGF 👉 Read our founder and CTO blog here: https://lnkd.in/giid5cxx Kudos to the Traefik Labs engineering team for delivering such an impactful release! #CloudNative #Kubernetes #PlatformEngineering #APIGateway #MemorySafety #FIPS #CyberResilienceAct #CRA #DevSecOps

What does MCP's own specification say about agent authorization? 🔐 It explicitly states that the core protocol lacks standardized permission or sandbox mechanisms, which means authorization is entirely the implementer's responsibility. In practice, this collapses to the authenticated principal: database MCP servers inherit database user permissions, Salesforce MCP servers inherit CRM role permissions, and GitHub MCP servers use the personal access token's full scope. Task, Tool, and Transaction-Based Access Control (TBAC) addresses this gap by authorizing at three progressive levels: the business-level task, the specific tools and MCP server methods in scope, and the granular transaction-level parameters for each operation ... all encoded in a JWT issued by your existing OAuth-compliant identity provider. Learn more about the Triple Gate Pattern here 👇 https://bit.ly/4wmEiZZ

A Token as a Service provider needs to do more than count how many tokens each customer consumes. Once inference becomes a multi-tenant service, the provider has to control access, requests, policies, and what agents can do afterward. That requires six capabilities around the inference infrastructure. 1️⃣ Tenant identity and entitlement Every request needs to be tied to a tenant identity. That identity determines which plan applies, which models the tenant can access, and which policies need to be enforced. Without it, quotas, routing, and audit records cannot be attributed reliably. 2️⃣ Token-level cost and quota control Token consumption can vary significantly. A short prompt may produce a long response, while an agent may call the model several times to complete one task. The service needs to estimate consumption before admitting the request, then count input, output, cached, and tool-related tokens by tenant, model, and route. This allows it to enforce rate limits and hard quotas before costs are exceeded. 3️⃣ Model and route policy Requests may need to be routed according to cost, latency, location, availability, or tenant policy. When applications call a provider directly, changing the model, provider, or deployment location can require application work. Moving that logic into the service layer provides a practical way to fail over when a provider becomes unavailable. 4️⃣ A composable safety pipeline One tenant may need PII protection and prompt-injection detection. Another may need topic controls or rules preventing internal identifiers from leaving the environment. Those guardrails need to be applied by tenant and route instead of through one fixed pipeline. 5️⃣ Agent and tool authorization An AI agent may continue working after the model responds. It might query a database, update a repository, or initiate a transaction. So the provider needs to control which tasks the agent may pursue, which tools it may invoke and which parameters it may use. An agent might be allowed to issue a refund, for example, but only up to a defined amount and on behalf of an authorized user. 6️⃣ Unified audit and observability The provider needs one record connecting the tenant identity, model call, token consumption, policies applied, tools invoked, and outcome. If each gateway or application produces a separate record, billing, security, and compliance teams have to reconstruct the workflow afterward. ➡️ In practice, these capabilities need to share identity, policy, and observability. Otherwise, each application or gateway ends up maintaining its own version of the tenant, usage data, and audit record. That becomes increasingly difficult to reconcile as the service adds more tenants, models, and agent workflows. If your team is mapping out these controls, we included a more detailed architecture and implementation checklist here: https://lnkd.in/gdpymF7M

Consolidating identity issuance and traffic enforcement into a single control plane doesn't create coherence. It's creates a new attack surface.🛡️ The issuance of identity and the enforcement of what that identity is permitted to do are different architectural responsibilities, operating on different telemetry, at different cadences, and with different failure modes. A traffic governance plane bound to a single identity provider becomes a fragmentation point the moment the environment spans workforce identity, machine identity, customer identity, and agentic identity issued through standards-based protocols. Architectural coherence is achieved through clean interfaces between distinct layers, not by bundling those layers together and calling it consolidation. Learn more about this and all the 7 layers of modern defense here 👇 https://bit.ly/44FaHPp

📣 BIG NEWS 📣 Traefik crossed two milestones at once: 1,000 contributors on GitHub and 3.5 billion pulls of the official Docker image. And it happened as the project enters its second decade, with 2026 on pace to be the most active year in Traefik history. A BIG thanks to the Traefik community and everyone who has contributed to this awesome project over the years. Read the full story here: https://bit.ly/4gSvypK

Every prior consumption-billed category taught us the same lesson. Electricity, bandwidth, cloud: buyers eventually demand a meter they trust. AI inference is next. Hyperscalers will sell Token as a Service (TaaS). Model providers will sell it. Substrate operators will sell it. Each offering will arrive with a meter operated by the seller. Buyers will accept that for the first contract, then push hard against it at renewal. So the defining question of the token economy is simple: whose meter is this? The meter must live in a layer that: 1. The buyer can operate inside their own jurisdiction or air gap 2. The seller can resell across multiple model providers and substrates 3. An auditor can inspect without depending on either party for the data That layer is the gateway plane. Immánuel Fodor and I published a full reference architecture for it today: the Triple Gate Pattern spanning the API, AI, and MCP surfaces, two distinct authorization domains (token-level cost control and TBAC for AI agents), three deployment topologies from shared tenancy to dedicated federated stacks, and a complete implementation checklist. One thing most TaaS designs miss: the meter must be able to federate. A provider serving regulated tenants on isolated, sometimes air-gapped stacks has a defensible meter per tenant and no defensible meter for the business. Solving that is what separates a TaaS provider from a TaaS vendor. TaaS is not a product category. It is an operating model. Full article: https://lnkd.in/gdpymF7M #TokenAsAService #SovereignAI #AIInfrastructure #InferenceEconomics #AIGateway #MCP

Why does token-level rate limiting alone leave a gap in your AI cost meter? 🤔 In our new reference architecture guide, we lay out why agentic workloads don't stop at the LLM call; they proceed into tool invocations, database queries, and downstream API calls, each its own metering event. An AI Gateway sees the model conversation but not what the agent does next, so it systematically underreports agentic consumption. Closing that gap requires TBAC (Tools/Tasks/Transactions-Based Access Control) via an MCP Gateway working alongside token-level controls, coordinated through shared JWT identity. See the full reference architecture for Token as a Service here 👇 https://bit.ly/4aUhDvu

In 2015, I pushed the first commits of a side project on Github. This week, that side project crossed two milestones at once: 1,000 contributors on GitHub, and 3.5 billion pulls of the official Docker image. That puts Traefik among the 15 most downloaded official images on Docker Hub, shoulder to shoulder with the operating systems, languages, and databases the entire industry runs on. But the number I keep coming back to is a different one: 2026 is on pace to be the most active year in the project's history. More pull requests merged than in any year before. At ten years old. No secret formula, just two bets that paid off: making the Ingress NGINX migration a non-event, and going all-in on Gateway API. We also had the honor of welcoming two new maintainers to the project this week 🥳 To every one of the 1,000: thank you. You built this. Open Source at its best! Full story 👉 https://lnkd.in/edZsGWpp #OpenSource #Kubernetes #CloudNative

🎉 Ten years in, and Traefik just had its biggest week ever. This week the project crossed two milestones at once: 🚀 3.5 billion pulls of the official Docker image 👥 1,000 contributors on GitHub. And the counter did not stop: we are already at 1,008 and climbing. And here is the part that matters most: 2026 is on pace to be the most active year in Traefik's history. 470 pull requests merged in the first six months alone, nearly double last year's pace. A ten year old project setting all time activity records is not normal. It is happening for three reasons: 1️⃣ We made the Ingress NGINX retirement a non-event. Traefik reads existing NGINX Ingress annotations natively, more than 80 of them, with no rewrites. 2️⃣ We went all in on Gateway API, helping shape the spec itself, including its extension into AI and LLM routing. 3️⃣ The journey from open source to enterprise is seamless. An in-place binary swap that preserves your existing OSS config, done in under 60 seconds. No replatform, no rewrite. Your routing rules and operational knowledge carry over intact, and you unlock one unified gateway for API, AI, and MCP governance. Docker pulls measure adoption. Contributors measure ownership. 1,008 people now own a piece of this project. To every one of them: thank you. And a warm welcome to our two newest maintainers, Kangmin Kim from Busan and Nándor Kollár from Munich 👏 If you have ever thought about contributing to open source, contributor #1009 is a good first issue away. The full story from our founder and CTO Emile Vauge is here 👇 https://lnkd.in/gVK6s_GR #OpenSource #Kubernetes #CloudNative #Traefik #APIGateway #AIGateway #MCP