Your domain, one CNAME, and the certificate is nobody's job

api.yourcompany.com should reach the container. On tunnel platforms that is a daemon to run, a connector to babysit, and a custom-domain tier to pay for. On a bare VPS it is certbot, a renewal cron, and an nginx block.

On Hoody: create an alias for the container's port, then add one CNAME record at your DNS provider, pointing your domain at the alias. The proxy detects the CNAME, provisions a Let's Encrypt certificate, and renews it from then on. Five to ten minutes later, your domain serves HTTPS.

Nothing runs on your side to keep it working. No daemon, no renewal calendar entry, no expiry email at 2 AM.

Your domain is one DNS record; the certificate is nobody's job.