The name moves, not the pointer

An alias remembers its container forever; container_id is the one field PATCH refuses. So how does api.acme.com reach the new container on the same server without a DNS change?

DELETE /api/v1/proxy/aliases/{old} releases acme-prod on that server immediately. POST /api/v1/proxy/aliases with the same alias: "acme-prod" and the new container_id re-issues it. The CNAME target was the name, the name is spelled the same, so the record at your registrar is untouched and the certificate still matches. Two requests, back to back, no TTL to wait out. The old container keeps running for the moment you want it back, which is the same two requests in reverse.

One boundary: the hostname carries the server's name, so this works between containers on one box. A different box is a real DNS change.