Traefik and Caddy both terminate TLS, route by hostname, and run in containers — and both claim to be “lightweight.” On a $5 VPS the difference matters: a reverse proxy that idles at 150 MB leaves you 850 MB for applications on a 1 GB plan, while one that idles at 40 MB leaves 960 MB. This comparison uses resident memory, binary size, handshake throughput, and renewal behaviour to work out which proxy is actually cheaper to run.
The short answer: Caddy costs less RAM and less configuration effort; Traefik costs less once you have more than about five services and want dynamic service discovery. Neither changes your monthly bill unless the proxy is the reason you jump from 1 GB to 2 GB — and for many deployments, it is.
Resource Footprint at Idle and Under Load
Both proxies are single static binaries written in Go, which means no runtime dependencies, no shared-library hell, and a small container image. Caddy’s binary is roughly 40 MB and its container image about 45 MB; Traefik’s binary is around 100 MB (it bundles many providers) with a container image near 150 MB. Disk usage is irrelevant on a 25 GB plan, but it does affect image pull time on first boot.
Memory is where the gap shows. Caddy with a dozen site blocks and automatic HTTPS idles around 25–45 MB resident. Traefik with the Docker provider enabled, a file provider, and metrics idles around 60–110 MB depending on how often it watches the Docker socket and how many routers it tracks. Both spike during a burst of new TLS handshakes, but the spike is short-lived and released.
On the same 1 vCPU / 1 GB box running a Node app (150 MB), PostgreSQL (200 MB), and Redis (40 MB), Caddy leaves roughly 550 MB of headroom; Traefik leaves about 500 MB. That difference rarely decides anything. It matters on a 512 MB plan, where 60 MB is 12% of total memory.
Throughput and TLS Handshake Cost
Raw request throughput on a budget vCPU is bounded by the kernel network stack and the vCPU itself long before either proxy becomes the bottleneck. Both will push well over 10,000 plain HTTP requests per second on a modern 2 vCPU instance. The interesting number is TLS handshakes per second, because that is where Go proxy performance diverges and where a misconfigured proxy on a small VPS actually gets noticed.
| Metric (1 vCPU / 1 GB, 2.5 GHz shared) | Caddy 2.8 | Traefik 3.x | Nginx (reference) |
|---|---|---|---|
| Idle RSS (12 sites) | 30–45 MB | 65–110 MB | 25–35 MB |
| Binary / image size | 40 MB / 45 MB | 100 MB / 150 MB | 2 MB / 50 MB |
| TLS handshakes/sec (ECDSA P-256) | ~2,200 | ~1,900 | ~2,600 |
| Proxy overhead at 1,000 req/s | ~9% CPU | ~11% CPU | ~6% CPU |
| Config reload | Zero-downtime API/admin | Zero-downtime, file-watch | Graceful via SIGUSR2 |
| Certificate renewal | Fully automatic | Automatic, needs resolver config | Manual or certbot |
Numbers are representative single-stream measurements on a shared vCPU; your own will vary 20–30% with kernel version and cipher selection. The ordering holds: Nginx is fastest per core, Caddy is close with a far simpler config, and Traefik pays a little for its dynamic routing layer.
The Hidden Cost: Configuration Time
At $5 per month, the proxy’s RAM is not the dominant cost — the hours you spend configuring it are, if you value your time at all. Caddy’s default config is a Caddyfile of three lines per site, with automatic HTTPS that obtains and renews certificates without a separate ACME client. A working TLS-terminated reverse proxy takes under ten minutes.
Traefik requires listeners, entrypoints, a certificate resolver, and routers plus services per container. The first working setup is thirty to sixty minutes even with examples, and debugging a missing label is a common afternoon. What you buy with that complexity is dynamic routing: start a new container with the right labels and Traefik picks it up with no reload, no config file edit, no restart.
If you run one to five services and change them rarely, Caddy’s simplicity wins on total cost. If you run ten or more containers that come and go, or you want to give other people a self-service way to expose a service, Traefik’s dynamic discovery pays for its complexity in reduced operational work.
Certificate Management and Failure Modes
Both issue Let’s Encrypt certificates automatically, but they fail differently. Caddy retries aggressively and keeps a working certificate in storage; if the ACME account hits a rate limit, the site keeps serving the old certificate until it expires and then fails closed. Caddy’s on-demand TLS mode can also be used to mint certificates at first request, which helps with hundreds of customer domains but needs a rate limit guard.
Traefik stores certificates in its own JSON store (or Consul/etcd) and is more prone to orphaned entries after a container is deleted and recreated with a new name. The symptom is a valid certificate for a router that no longer exists and occasional renewal churn. Cleaning the store periodically is worth the two minutes.
Neither proxy will save you from a DNS misconfiguration, and both fail closed on missing certificates, which is correct but means a name that was working yesterday can go dark today if an A record changes. Add a monitor that hits each hostname over HTTPS every five minutes.
What the Proxy Does to Your Plan Choice
This is the part that turns a 60 MB difference into dollars. Budget plans step up in RAM roughly as follows: 512 MB at $2.50–$3.50, 1 GB at $3–$5, 2 GB at $5–$9, 4 GB at $10–$16. If your app stack uses 620 MB, a proxy at 40 MB fits a 1 GB plan with margin; a proxy at 110 MB may push you to 2 GB — an extra $3–$5 per month, $36–$60 per year.
That is the real cost difference, and it applies only when you are near a tier boundary. Measure actual RSS with ps or a container stats view before upgrading, and remember that the kernel page cache makes reported free memory look worse than it is. The plan features and RAM tiers on the budget hosting breakdown show where the boundaries fall for the providers in the comparison.
When a Proxy Is Not Worth Running
If you run a single application with its own TLS and no other services, the proxy adds 30–110 MB and a failure point for no benefit. Many apps — Ghost, Gitea, Miniflux, Jellyfin — terminate TLS themselves or run comfortably behind a plain Caddy one-liner. Adding Traefik to a single-service box is a common over-engineering mistake that turns a $3 plan into a $6 plan for no gain.
Where a proxy earns its keep: more than three backends on one IP, mixed HTTP and WebSocket traffic, per-route rate limiting, or a single place to enforce security headers and access logs. In those cases the 40 MB is well spent, and it replaces several plugins or per-app configurations.
Recommendation by Deployment Size
One to five services on a 1 GB plan: use Caddy. The Caddyfile is short enough to review in one screen, backups are trivial, and idle memory leaves room for a database. Ten or more containers on a 2 GB plan: use Traefik, accept the 90 MB idle footprint, and invest in a labelled, documented compose stack. Single-app boxes: skip the proxy and terminate TLS in the app.
Whichever you pick, budget it explicitly. A proxy is a service on your server with a memory cost and a crash cost. Move it into the monthly line-item model alongside the database and backups, and check the budget VPS comparison table for plans where the next RAM tier up costs less than the time you would spend optimising a 512 MB box.
