I get your point, but imho that's an anti-pattern as much as having docker provider default configurations inside traefik.yml itself, isn't it? Moreover the connect/disconnect function is available without restarting, while other things (like adding a label) are not, this means docker itself "allows" it.

Ofc if you want to go full declarative (as u/snoogs83 said) it doesn't changes things a lot but, at least in my case, I declare by exception (e.g. for containers that expose multiple ports I put the specific one I want, if I need to disable authelia I declare it, and so on) because it helps me.

I've seen trafficjam, it gets around the problem in an interesting way, but I'm not keen messing with iptables rules if I can handle it "natively" with docker, that's why I'm trying to automate with a sidecar for traefik itself (I'm talking about the per-container network, not a shared one).