I updated a service running behind Traefik with a routine docker compose up -d. The container recreated, came up healthy, responded fine when I hit it directly on the Docker network — and Traefik served it a 502 Bad Gateway for the next couple of minutes. Restarting Traefik fixed it instantly. Then it happened again on the next recreate.

The 502 wasn’t random, and the real fix wasn’t “restart Traefik.” That was just a band-aid over a config bug.

What actually happens

Traefik’s Docker provider routes to a container by its IP on a specific Docker network. When you recreate a container, it gets a new IP. Traefik watches Docker events and is supposed to re-resolve the backend automatically — and usually it does. But if Traefik can’t confidently tell which network the container is on, that re-resolution gets flaky, and you get transient 502s to a stale endpoint until something forces a clean refresh.

The reason it couldn’t tell was sitting in the logs the whole time:

WRN Could not find network named "web" for container "/app".
    Maybe you're missing the project's prefix in the label?
WRN Defaulting to first available network ("myproj_web") for container "/app".

The mismatch

Traefik was configured with:

- "--providers.docker.network=web"

But this is a Docker Compose stack, and Compose prefixes network names with the project name. The network declared as web in the compose file is actually created as myproj_web on the host. So the name Traefik was told to use never matched a real network. On every container discovery, Traefik shrugged and “defaulted to the first available network” — which happens to land on the right one, but that guesswork is exactly what goes stale when an IP changes underneath it.

Confirm the real name yourself:

docker network ls | grep <yourstack>
# or, for a specific container:
docker inspect <container> -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}}{{end}}'

The fix

Tell Traefik the network’s real name — the prefixed one:

- "--providers.docker.network=myproj_web"

Recreate Traefik once, the warning is gone, backend resolution is deterministic, and recreating a service behind it no longer 502s — no Traefik restart required.

Two alternatives if you’d rather not hardcode the prefix:

• Pin the network name so Compose doesn’t prefix it — add name: web under the network definition. (This recreates the network, so every container reconnects; do it in a maintenance window.)
• Set it per-service with a traefik.docker.network=myproj_web label instead of the global provider flag.

The lesson

The 502 looked like a Traefik-vs-Docker race condition. It was really a name that never matched, degraded into a warning nobody read, and only became visible when a backend’s IP changed underneath it. When a proxy misbehaves intermittently, read its startup warnings first — the bug is often sitting right there in plain WRN.