> I eventually decided to exposing /var/run/docker.sock to my Certbot container

Don't do this, please. It is a security risk as access to the docker socket can be used to take over the entire system as root.