A multi-container site: this home page, an admin dashboard and a REST API, each in its own Docker container behind one Nginx reverse proxy.
Every service runs in its own container, so you can update or restart one without touching the others.
Containers listen only on localhost. Nginx is the single public entry point, with HTTPS via Certbot.
Add a new service with a few lines in docker-compose.yml and one location block in Nginx.