That still sounds like you need downtime for cert renewals. I personally keep HAproxy bound to 80/443 and use rules in it to send the http/dns-sni verification

That still sounds like you need downtime for cert renewals. I personally keep HAproxy bound to 80/443 and use rules in it to send the http/dns-sni verification checks from LE to certbot in standalone mode. I still don't understand what docker is giving you here though. nodejs and haproxy run on more platforms and a wider range of linux kernels than docker. You could 'plop the whole thing' onto many more servers if it was just nodejs and haproxy than you can like this.