Learn Traefik - Compression & Buffering

#Introduction

After protecting the backend from surges, it is time to make traffic more efficient. Episode 13 covers three middlewares that save bandwidth and stabilize memory: Compress, Buffering, and ContentType.

Compress shrinks responses before sending — with a direct impact on page speed. Buffering controls how much request and response data Traefik may "hold", preventing abuse and maintaining memory stability. ContentType ensures the browser receives the correct content type. All three are simple to install but have a big impact in production.

#The Compress Middleware

#Gzip and Brotli

Compress compresses responses with the gzip or brotli algorithm, depending on the client's Accept-Encoding header. The minimal compress middleware configuration:

http:
  middlewares:
    app-compress:
      compress:
        excludedContentTypes:
          - text/event-stream
        minResponseBodyBytes: 2048

• excludedContentTypes: content types that must not be compressed — an important example: text/event-stream for streaming Server-Sent Events, because compression would delay the delivery of each event.
• minResponseBodyBytes: the minimum response size before compressing (default 1024 bytes). Small responses are not worth compressing because the header overhead is larger than the savings.

Traefik automatically determines content type and only compresses types that benefit: text, JSON, HTML, and others. JPEG and PNG images are already compressed, so they do not need re-compression.

#Best Practices

Install Compress on the main router or as a global middleware for web services. Make sure the Vary: Accept-Encoding header remains so CDN caches do not mix compressed and uncompressed versions. Docker labels for installation:

services:
  web:
    image: nginx:alpine
    labels:
      - traefik.enable=true
      - traefik.http.routers.web.rule=Host(`web.localhost`)
      - traefik.http.routers.web.middlewares=app-compress
      - traefik.http.middlewares.app-compress.compress.minresponsebodybytes=2048
      - traefik.http.routers.web.service=web-svc
      - traefik.http.services.web-svc.loadbalancer.server.port=80

#The Buffering Middleware

#Limiting Request and Response Sizes

Buffering holds requests and responses fully in memory before forwarding them. This allows inspection and size limits, while also ensuring the entire payload is valid:

http:
  middlewares:
    api-buffer:
      buffering:
        maxRequestBodyBytes: 1048576
        memRequestBodyBytes: 2097152
        maxResponseBodyBytes: 2097152
        memResponseBodyBytes: 2097152
        retryExpression: "StatusCode() == 502"

• maxRequestBodyBytes: the request size limit; larger requests are rejected.
• memRequestBodyBytes: the limit that can be held in memory; the rest is streamed to disk.
• maxResponseBodyBytes: the response size limit from the backend.
• retryExpression: the expression that triggers a retry — above, a retry runs if the backend returns 502.

#Memory vs. Overhead

Buffering gives full control but at a price: large requests are held in memory or streamed to disk, adding latency and I/O usage. For large streaming such as file uploads, buffering can be an obstacle. Rule of thumb: enable buffering only when you truly need content inspection or strict size limits.

#The ContentType Middleware

#Automatic Content Type Detection

ContentType automatically adds the Content-Type header based on response content, if the backend does not provide it:

http:
  middlewares:
    auto-ct:
      contentType:
        autoDetect: true

• autoDetect: true: Traefik analyzes the first bytes of the response to determine the correct content type.
• If autoDetect: false, the middleware removes Content-Type from the backend response.

This middleware is useful when a backend returns a payload without a Content-Type header — a browser left to guess could misinterpret data as HTML and open an XSS hole. Combine it with X-Content-Type-Options: nosniff from episode 10 for layered defense.

#Closing

Key takeaways:

• Compress compresses responses with gzip or brotli.
• Do not compress text/event-stream and already compressed files.
• Buffering holds payloads in memory with configurable limits.
• retryExpression on buffering can trigger retries based on status codes.
• ContentType adds the correct Content-Type if the backend forgets it.
• Combine with nosniff to prevent MIME sniffing.

In episode 14 next we enter the TLS phase: TLS configuration — TLS termination versus passthrough, TLS versions and cipher suites, TLSOption for advanced configuration, certificate sources from files to Let's Encrypt, and default certificates and SNI. This is where your services move from plain HTTP to HTTPS.