Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Run Uptime Kuma as a Docker Compose service on port 3001, attach it to the same Docker network as Traefik, and route a dedicated hostname to it with Traefik labels. Use an HTTPS router with TLS and a certificate resolver, keep WebSocket upgrades enabled, and store /app/data on a local filesystem that supports POSIX file locking. This arrangement gives Uptime Kuma a secure hostname such as status.example.com without exposing its container port directly to the internet.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the finished deployment looks like
Uptime Kuma listens inside its container on TCP port 3001. Traefik accepts the public HTTPS request, selects a router whose rule matches your hostname, and forwards the request to port 3001 on the Uptime Kuma container. The browser then maintains the WebSocket connection that Uptime Kuma uses for live status updates.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe design has four separate pieces that must agree:
- DNS: the hostname must resolve to the server running Traefik.
- Traefik: its HTTPS entrypoint and certificate resolver names must match the names in the labels.
- Docker networking: Traefik and Uptime Kuma must share a reachable network.
- Uptime Kuma storage: the host directory mounted at
/app/datamust support reliable POSIX-style file locking.
Use a hostname or subdomain, not a path such as example.com/uptimekuma. The Uptime Kuma project’s reverse-proxy guidance says subdirectory URLs are unsupported.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Prerequisites to check first
A running Traefik installation
This guide assumes Traefik is already running as the public entry point and has an HTTPS entrypoint (commonly named https) plus a certificate resolver (for example, myresolver). Those names are deployment-specific. Inspect Traefik’s static configuration and use its exact names in the Compose labels.
A DNS record for the chosen hostname
Create an A or AAAA record for the hostname in your Host(...) rule, pointing to the server where Traefik receives traffic. If DNS points elsewhere, Traefik cannot receive the request and certificate issuance will fail regardless of the container labels.
Recommended Free Tools
A shared Docker network
Traefik’s Docker provider discovers containers from labels, but it still needs an actual Docker network path to the backend. Find the network Traefik uses for proxied services. In the examples below it is called traefik-public; substitute your real network name.
Persistent storage on a lock-capable filesystem
Uptime Kuma stores its data under /app/data, including its SQLite database. The installation guidance warns that unsupported filesystems such as NFS can cause SQLite corruption. Use a local filesystem or another filesystem that correctly supports POSIX locking.
Compose file: the minimal service
The official Compose example uses the louislam/uptime-kuma:2 image, restarts unless stopped, mounts a local data directory, and publishes port 3001:
services:
uptime-kuma:
image: louislam/uptime-kuma:2
restart: unless-stopped
volumes:
- ./data:/app/data
ports:
- "3001:3001"Start it from the directory containing the Compose file with:
Rank #2
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- CanaKit Mega Heat Sink - Black Anodized
docker compose up -dThe ports mapping is useful for a first local check or for a deployment where Uptime Kuma must also be reachable directly. When Traefik is the only public entry point, you can omit that mapping and expose the service only on the shared Docker network. Removing the host mapping does not change Uptime Kuma’s container port: Traefik must still forward to 3001.
Compose file for Traefik routing
This variant adds the labels required by the official Uptime Kuma Traefik example and attaches the service to an existing network. Replace the hostname, entrypoint, resolver, and network with values from your installation.
services:
uptime-kuma:
image: louislam/uptime-kuma:2
restart: unless-stopped
volumes:
- ./data:/app/data
networks:
- traefik-public
labels:
- "traefik.enable=true"
- "traefik.http.routers.uptime-kuma.rule=Host(`status.example.com`)"
- "traefik.http.routers.uptime-kuma.entrypoints=https"
- "traefik.http.routers.uptime-kuma.tls=true"
- "traefik.http.routers.uptime-kuma.tls.certresolver=myresolver"
- "traefik.http.services.uptime-kuma.loadBalancer.server.port=3001"
networks:
traefik-public:
external: trueWhat each label does
| Label | Purpose |
|---|---|
traefik.enable=true |
Explicitly enables Traefik discovery for this container. |
traefik.http.routers.uptime-kuma.rule=Host(`status.example.com`) |
Matches requests whose host header is the chosen hostname. |
traefik.http.routers.uptime-kuma.entrypoints=https |
Restricts the router to the HTTPS entrypoint named https. |
traefik.http.routers.uptime-kuma.tls=true |
Enables TLS processing on that router. |
traefik.http.routers.uptime-kuma.tls.certresolver=myresolver |
Requests a certificate through the configured resolver named myresolver. |
traefik.http.services.uptime-kuma.loadBalancer.server.port=3001 |
Forces Traefik to send traffic to Uptime Kuma’s container port 3001. |
Traefik can sometimes infer a port, but the explicit service-port label removes ambiguity and is especially important when the container has no host-port mapping. The label overrides automatic port detection.
Deploy it in the right order
- Create the project directory. Make a directory for the Compose file and its persistent data directory. The relative mount
./data:/app/datakeeps the database beside the Compose project. - Confirm the external network exists. Run
docker network lsand verify the network name used in the file. If Traefik uses a different network, change the Compose file rather than creating an unrelated network. - Check DNS. Resolve
status.example.comand confirm it reaches the Traefik host before troubleshooting Uptime Kuma. - Save the Compose file. Keep the labels exactly syntactically valid. YAML indentation and backticks inside the
Host(...)rule matter. - Start the service. Run
docker compose up -d. - Inspect startup state. Use
docker compose psanddocker compose logs uptime-kuma. The container should remain running rather than repeatedly restarting. - Open the HTTPS hostname. Visit
https://status.example.com. Complete Uptime Kuma’s initial setup in the browser. - Verify live behavior. Open the browser’s developer tools and watch the network connection while the dashboard loads and updates. Also inspect Traefik logs if the page loads but live updates do not.
HTTPS and certificate automation
The TLS labels tell Traefik to terminate HTTPS and use its configured certificate resolver. With a correctly configured resolver, the Uptime Kuma project documents that Traefik can obtain a Let’s Encrypt certificate automatically. Certificate issuance still depends on your Traefik challenge configuration, reachable DNS, and the entrypoint being available as required by that challenge.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not invent a resolver name in the label. If Traefik’s static configuration calls it letsencrypt, use letsencrypt instead of myresolver. The same applies to the entrypoint: https is an example, not a universal default.
If the certificate is not issued, separate the problem into two checks:
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
- Can a request for the hostname reach Traefik’s HTTPS entrypoint?
- Does the resolver name and challenge configuration match the certificate request?
Only after those checks succeed should you investigate the Uptime Kuma container.
Why WebSockets matter
Uptime Kuma is WebSocket-based. The project’s reverse-proxy guidance specifically notes that a proxy must handle the Upgrade and Connection headers for WebSocket connections. Traefik’s HTTP routing must therefore remain in the path and preserve the upgrade flow; do not replace it with a proxy configuration that only forwards ordinary HTTP requests.
A successful initial page load does not prove WebSockets work. The HTML and JavaScript can arrive over a normal request while the live connection fails afterward. Symptoms include a dashboard that does not refresh, monitors that appear stale, or a browser connection error after login.
WebSocket troubleshooting sequence
- Confirm the browser is using the HTTPS hostname covered by the router rule, not a different hostname or a direct port.
- Check Traefik logs for the request and for backend connection errors.
- Verify that Traefik and Uptime Kuma share the same reachable Docker network.
- Confirm the service label still points to port 3001.
- Use browser developer tools to see whether the WebSocket handshake receives an HTTP error or simply cannot connect.
There is normally no separate Uptime Kuma WebSocket port to expose. The WebSocket handshake uses the same routed service and container port.
Docker networking details
Compose’s network declaration controls whether Traefik can reach the service. Marking a network as external: true tells Compose to use a network created elsewhere, typically by the Traefik stack. The name must match exactly.
| Deployment arrangement | Host port mapping | Required network action |
|---|---|---|
| Traefik and Uptime Kuma in separate Compose projects | Usually omitted | Attach Uptime Kuma to Traefik’s existing external network. |
| Both services in one Compose project | Optional | Place both services on the same Compose network. |
| Direct access needed for local administration | 3001:3001 |
Still share a network if Traefik will proxy the public hostname. |
If Traefik reports that no server is available, a shared network is the first thing to verify. Being on the same Docker host is not sufficient when the containers are isolated on different networks.
Rank #4
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Trusting forwarded headers and client IPs
When Uptime Kuma is fully behind a reverse proxy and firewall rules prevent direct access to the application, its reverse-proxy guidance allows you to enable Settings → Reverse Proxy → HTTP Headers → Trust Proxy. This makes Uptime Kuma trust forwarded headers so the client IP can appear correctly in logs.
Enable this only when Traefik is the controlled proxy in front of the application and direct untrusted access is blocked. Trusting forwarded headers from arbitrary clients would allow those clients to supply misleading address information.
Decide whether to expose port 3001
Keep the mapping during initial setup
Keeping "3001:3001" lets you test the container directly from the host while configuring Traefik. It can help distinguish an application problem from a routing problem, but it also creates a second access path that must be protected by your firewall.
Remove the mapping for a proxy-only service
Once Traefik is confirmed as the public entry point, omit ports. Uptime Kuma remains reachable to Traefik over Docker networking, while port 3001 is no longer published on the host. The service-port label remains mandatory because it tells Traefik which internal port to use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Filesystem and persistence pitfalls
The data mount is not optional for a reliable deployment. Without persistent storage, recreating the container can remove the application database and configuration. The official installation guidance also warns that SQLite needs a filesystem with appropriate local/POSIX locking behavior. NFS is specifically called out as an unsupported choice that can lead to corruption.
- Keep
./dataon a local disk or a filesystem known to provide POSIX locks. - Do not move the directory to NFS merely because it is convenient for shared storage.
- Back up the data directory before upgrades or host migrations.
- Check filesystem permissions if the container starts but cannot initialize its database.
The Compose mount is a directory bind mount, so the location and permissions of the host directory directly affect the application inside the container.
Best Value
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 32GB EVO+ Micro SD Card pre-loaded with 64-bit Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit 45W PD Power Supply for the Raspberry Pi 5
- Display Cable - 6 foot (Supports up to 4K 60p)
Troubleshooting by symptom
The hostname times out or shows no route
- Verify the DNS record points to the Traefik host.
- Confirm the router rule uses the same hostname the browser requests.
- Check that the HTTPS entrypoint named in the label exists in Traefik.
- Make sure firewall rules allow traffic to Traefik’s public HTTPS listener.
Traefik returns a 404
A 404 from Traefik commonly means no router rule matched. Check spelling, DNS, and the Host(`...`) syntax. A request to an IP address will not match a hostname rule unless you deliberately created a rule for that IP.
Traefik returns 502 or reports no available server
- Confirm both containers are attached to the same Docker network.
- Confirm the label specifies
loadBalancer.server.port=3001. - Check that the Uptime Kuma container is running and listening on port 3001.
- Inspect container and Traefik logs for network or connection errors.
The page loads but live updates fail
Focus on WebSocket handling rather than certificate issuance. Check the browser’s WebSocket handshake, Traefik logs, network reachability, and the fact that the request uses the same HTTPS hostname. Uptime Kuma’s WebSocket traffic should traverse the same router and backend port.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The database becomes corrupt or the service behaves inconsistently
Inspect the storage location first. Move ./data off NFS or another filesystem without dependable POSIX locking, restore a known-good backup if necessary, and restart only after the storage path is stable.
Hostname routing versus subdirectory routing
| Routing style | Uptime Kuma support | Operational implication |
|---|---|---|
https://status.example.com |
Supported guidance | Use a dedicated router with a Host(...) rule. |
https://example.com/uptimekuma |
Not supported by the project’s reverse-proxy guidance | Use a domain or subdomain instead of path-prefix rewriting. |
This distinction is important when an existing site already occupies the main domain. Give Uptime Kuma its own hostname rather than trying to mount it below that site’s URL path.
Final verification checklist
- The DNS record resolves to the Traefik server.
- The
Host(...)rule exactly matches the hostname in the browser. - The router uses the actual HTTPS entrypoint name from Traefik’s configuration.
- The TLS certificate resolver label matches the configured resolver.
- Uptime Kuma and Traefik share a reachable Docker network.
- The backend service label targets container port 3001.
./datais mounted at/app/dataand stored on a lock-capable filesystem.- The HTTPS page loads and the WebSocket connection remains established.
- Port 3001 is unpublished if Traefik is intended to be the only public entry point.
- Trust Proxy is enabled only when Traefik is trusted and direct access is restricted.
With those pieces aligned, the deployment is a straightforward Docker service behind a hostname-based Traefik router: persistent data stays in /app/data, HTTPS terminates at Traefik, and WebSocket traffic reaches Uptime Kuma on port 3001.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
