Using nginx and a let's encrypt client on the host, the certificates are only generated and kept inside the machine itself. That's safer than baking them into the Docker image, which will be copied around.