How do you put a reverse proxy in front of containers?

The proxy is the only service that publishes ports 80 and 443. Application containers stay on an internal network and are reached by service name. This centralises TLS, routing, compression and request limits.

server {
  listen 443 ssl;
  server_name api.example.com;

  ssl_certificate /etc/letsencrypt/live/api/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/api/privkey.pem;

  location / {
    proxy_pass http://api:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60s;
  }
}

Things that bite

• WebSocket upgrades need explicit Connection and Upgrade headers
• Large uploads need a body size limit and a longer timeout
• The app must trust forwarded headers only from the proxy
• TLS certificates need renewal and a reload strategy
• Health checks should target the proxy and the app separately

Traefik and Caddy can discover containers through labels or the Docker API and manage certificates automatically. That reduces configuration, but it also means the proxy needs access to the Docker socket or a discovery mechanism, which is a security consideration.