diff --git a/cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/TraefikLabelBuilder.java b/cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/TraefikLabelBuilder.java
new file mode 100644
index 00000000..261e26f0
--- /dev/null
+++ b/cameleer3-server-app/src/main/java/com/cameleer3/server/app/runtime/TraefikLabelBuilder.java
@@ -0,0 +1,49 @@
+package com.cameleer3.server.app.runtime;
+
+import com.cameleer3.server.core.runtime.ResolvedContainerConfig;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+public final class TraefikLabelBuilder {
+
+    private TraefikLabelBuilder() {}
+
+    public static Map<String, String> build(String appSlug, String envSlug, ResolvedContainerConfig config) {
+        String svc = envSlug + "-" + appSlug;
+        Map<String, String> labels = new LinkedHashMap<>();
+
+        labels.put("traefik.enable", "true");
+        labels.put("managed-by", "cameleer3-server");
+        labels.put("cameleer.app", appSlug);
+        labels.put("cameleer.environment", envSlug);
+
+        labels.put("traefik.http.services." + svc + ".loadbalancer.server.port",
+                String.valueOf(config.appPort()));
+
+        if ("subdomain".equals(config.routingMode())) {
+            labels.put("traefik.http.routers." + svc + ".rule",
+                    "Host(`" + appSlug + "-" + envSlug + "." + config.routingDomain() + "`)");
+        } else {
+            labels.put("traefik.http.routers." + svc + ".rule",
+                    "PathPrefix(`/" + envSlug + "/" + appSlug + "/`)");
+
+            if (config.stripPathPrefix()) {
+                labels.put("traefik.http.middlewares." + svc + "-strip.stripprefix.prefixes",
+                        "/" + envSlug + "/" + appSlug);
+                labels.put("traefik.http.routers." + svc + ".middlewares",
+                        svc + "-strip");
+            }
+        }
+
+        labels.put("traefik.http.routers." + svc + ".entrypoints",
+                config.sslOffloading() ? "websecure" : "web");
+
+        if (config.sslOffloading()) {
+            labels.put("traefik.http.routers." + svc + ".tls", "true");
+            labels.put("traefik.http.routers." + svc + ".tls.certresolver", "default");
+        }
+
+        return labels;
+    }
+}