traefik:v3 image size, layers and vulnerabilities (2026-11-01)

docker pull traefik:v3traefik@sha256:e9338a01a43389362bdef90afd4ff4a30dd6c0a2e1b0ce00c5e0f52659aa2d9c

Size per platform

Compressed download size on Docker Hub for each architecture.

amd6455 MB
s390x53 MB
riscv6453 MB
arm/v651 MB
arm6450 MB
ppc64le48 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/local/bin185 MB
/usr/lib6.2 MB
/bin805 kB
/lib670 kB
/usr/share/zoneinfo452 kB
/etc/ssl204 kB
/usr/share/ca-certificates179 kB
/usr/bin151 kB
/sbin115 kB
/usr/lib/engines-3102 kB

Layers

The 4 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (alpine-minirootfs-3.3.9 MB
2. RUN apk --no-cache add ca-certificate412 kB
3. RUN … download51 MB
4. COPY entrypoint.sh → /369 B

Full build steps

3.9 MBADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit
412 kBRUN /bin/sh -c apk --no-cache add ca-certificates tzdata # buildkit
51 MBRUN /bin/sh -c set -ex; apkArch="$(apk --print-arch)"; case "$apkArch" in armhf) arch='armv6' ;; armv7) arch='armv7' ;; aarch64) arch='arm64' ;; x86_64) arch='amd64' ;; riscv64) arch='riscv64' ;; s390x) arch='s390x' ;; ppc64le) arch='ppc64le' ;; *) echo >&2 "error: unsupported architecture: $apkArch"; exit 1 ;; esac; wget --quiet -O /tmp/traefik.tar.gz "https://github.com/traefik/traefik/releases/download/v3.7.17/traefik_v3.7.17_linux_$arch.tar.gz"; tar xzvf /tmp/traefik.tar.gz -C /usr/local/bin traefik; rm -f /tmp/traefik.tar.gz; chmod +x /usr/local/bin/traefik #
369 BCOPY entrypoint.sh / # buildkit

Known vulnerabilities

0Critical0 with a fix

1High1 with a fix

1Medium1 with a fix

0Low0 with a fix

3Unknown2 with a fix

5 findings across 377 packages; 4 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
High	CVE-2026-116587github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs	github.com/go-jose/go-jose/v4installed v4.1.5	4.1.6
Medium	GHSA-2hw4-c9m4-f2fjknative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion	knative.dev/pkginstalled v0.0.0-20251216153728-9c8140b780d1	0.0.0-20260531000007-52dbd5ece63f
Unknown	CVE-2026-78661When coalescing adjacent text nodes in addText and fosterParent, appen ...	golang.org/x/netinstalled v0.60.0	0.62.0
Unknown	CVE-2026-97045In childTextNodesAreLiteral, walking up the tree previously stopped at ...	golang.org/x/netinstalled v0.60.0	0.62.0
Unknown	GO-2026-5932The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues	golang.org/x/cryptoinstalled v0.57.0	no fix yet

Packages

Go modules: 359
Alpine packages: 18

Image configuration

Base OS: Alpine Linux 3.24.3
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: /entrypoint.sh
Command: traefik
Exposed ports: 80/tcp
Image created: 2026-10-21
amd64 digest: sha256:abb2b9c1b132b5b0be40d09c85bf8d3dab2a59fa0eb3aa955ab8be5efbb73de6

Other Traefik tags

haproxy:3.2-alpine vs traefik:v3

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:abb2b9c1b132. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.