Reverse Proxy

Caddy is a good default choice here mainly because of one feature: automatic HTTPS. Point a domain's DNS at the host, add a block referencing the container name, and Caddy handles Let's Encrypt issuance and renewal without a separate cron job.

example.com {
    reverse_proxy app:3000
}

Run Caddy itself as its own long-lived container on gateway-net, entirely separate from any application's lifecycle.