Compose service domain may keep returning 502 until the domain is deleted and recreated

[sercherton]

To Reproduce

Problem

A domain attached to a Docker Compose sub-service may return 502 Bad Gateway even though the target container is healthy and the app responds correctly on the configured internal port.

A normal redeploy does not always fix it.

What fixes it reliably is:

1. delete the domain in Dokploy
2. create the same domain again
3. redeploy / refresh routing

Expected

If a Compose sub-service is healthy and the domain points to the correct internal port, redeploy should be enough.

Deleting and recreating the domain should not be required.

Actual

• container is up
• service responds correctly inside the container
• public domain still returns 502

Current vs. Expected behavior

Example:

docker exec <container> sh -lc 'wget -qO- http://127.0.0.1:8080/healthz'
{"status":"ok"}

curl -fsS https://<domain>/healthz
curl: (22) The requested URL returned error: 502

### Provide environment information

```bash
ubuntu 24.04
Dokploy Version v0.28.4
Compose App

Which area(s) are affected? (Select all that apply)

Application

Are you deploying the applications where Dokploy is installed or on a remote server?

Remote server

Additional context

No response

Will you send a PR to fix it?

Yes

[dosubot]

Hi @sercherton! I'm Dosu and I’m helping the dokploy team.

This is a known issue related to timing/race conditions in isolated deployments. There are a few root causes:

1. Race Condition with Traefik Network Connection

In isolated deployments, Traefik connects to the custom network after containers start:

docker compose up -d
docker network connect ${compose.appName} $(docker ps --filter "name=dokploy-traefik" -q)

This creates a window where containers are up with Traefik labels, but Traefik can't reach them yet → 502.

2. Multiple Networks Confusing Traefik

If your service attaches to multiple Docker networks, Traefik can't automatically determine which one to use. The fix is adding an explicit network label to your service:

labels:
  - "traefik.docker.network=dokploy-network"  # or your-app-isolated-network for isolated deployments

Workaround for your PR:
The core fix would likely involve connecting Traefik to the network before starting the containers, or adding a retry/wait mechanism. The network connection errors are currently silenced, which makes debugging harder.

Related issues/PRs: #752, #2830, PR #3030 (fixed a similar label-writing issue in Jan 2025).

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[Siumauricio]

Can you share the docker compose you are using? @sercherton

[sercherton]

and how to share it? пн, 9 мар. 2026 г. в 01:08, Mauricio Siu ***@***.***>:

…

*Siumauricio* left a comment (Dokploy/dokploy#3945) <#3945 (comment)> Can you share the docker compose you are using? @sercherton <https://github.com/sercherton> — Reply to this email directly, view it on GitHub <#3945 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB7CNXKTPZAF4OVOZ5EZHO34PXVNZAVCNFSM6AAAAACWLC6RQ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DAMRQGEYTONJQGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[arditramaj1]

I have the same issue and I cannot fix it. I thought it was an error with traefik or a dokploy bug. Does updating dokploy fix this issue? I am currently on version v0.26.7

[whilmarbitoco]

same issue here

[whilmarbitoco]

I found a solution! Dokploy is injecting its own labels onto your containers at deploy time regardless of what's in your compose file. This is Dokploy's own behavior it adds web and websecure router labels to every service it deploys. The fix is simple, go to the Dokploy dashboard, find the domain entry for your domain that's configured on all services, and delete it. Your compose file with traefik labels are enough. Hope this helps.

P.S. I'm not quite sure if this is solution is correct.

[arditramaj1]

I did not use traefik labels in my docker compose. I just used the domains tab to create the domains and let dokploy deal with it. Should I create the labels manually in docker compose and not do anything in domains tab?

[whilmarbitoco]

It's worth trying, you can find the details here: https://medium.com/@whilmarbitoco/fixing-502-bad-gateway-with-path-based-routing-in-dokploy-4d321ccf4f12

[arditramaj1]

As far as I have tested, your idea works. We tested with two different projects, one with manual labels in docker compose and it worked.

[djsisson]

in the above case you can add traefik.http.routers.auth-ms.service=auth-ms dokploy should really be adding this to, however the service is usually the same in which case it doesn't matter, but when you route to a different loadbalancer port (an actual different service in traefik) you need to specify which router is using which service