Docker allowEmptyServices results in 500 internal server error for unhealthy container

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you do?

We're using the Docker provider

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik
    allowEmptyServices: true
  file:
    directory: /etc/traefik/dynamic

And expected a 503 Service Unavailable, when a docker container becomes unhealthy (with allowEmptyServices: false we see the expected 404 Not Found).

What did you see instead?

Everything works as expected as long as the container is healthy, so I assume our config is correct.

But when the container is unhealthy, we get a 500 Internal Server Error with the following log messages

{"level":"debug","time":"2026-06-01T16:52:40+02:00","caller":"github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:251","message":"Service selected by WRR: "}
{"level":"debug","error":"unsupported protocol scheme \"\"","time":"2026-06-01T16:52:40+02:00","caller":"github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:182","message":"500 Internal Server Error"}

At the moment the container became unhealthy we're also seeing the "Configuration received" log message with the following entry for the service in question:

{"loadBalancer":{"servers":[{}],"strategy":"wrr","passHostHeader":true,"responseForwarding":{"flushInterval":"100ms"}}}

My guess is that the empty entry in servers is confusing some part of the code, which expects an empty list instead of a list with a single empty entry. AFAIK the empty entry is read and the proxy code tries to load the URL "" (empty string) and then complains about the invalid (empty) URL scheme.

What version of Traefik are you using?

Version:      3.7.1
Codename:     langres
Go version:   go1.25.10
Built:        2026-05-11T13:15:43Z
OS/Arch:      linux/amd64

What is your environment & configuration?

entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure

  websecure:
    address: :443
    http3: {}
    http:
      tls:
        certResolver: default

accessLog:
  format: common
  filePath: /var/log/traefik/access.log
log:
  level: DEBUG
  format: json

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik
    allowEmptyServices: true
  file:
    directory: /etc/traefik/dynamic

certificatesResolvers:
  default:
    acme:
      email: ***
      storage: /var/lib/traefik/acme.json
      tlsChallenge: {}

api: {}
ping: {}

Add more configuration information here.

# /etc/traefik/dynamic/traefik-api.yml
http:
  routers:
    dashboard:
      rule: Host(`127.0.0.1`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))
      service: api@internal

If applicable, please paste the log output in DEBUG level

See above