I funnily had the same use case. Two different jellyfin servers for complete separation. Both routing through gluetun. The reason this doesn’t work is because the network mode setting you have basically makes all three containers operate in the same network. Meaning if one binds a port the others can no longer bind the same port. Their different hosts but all sharing one network and port range. To expose the ports you can move that ports setting from C1/C2 to the gluetun service definition. This’ll still work because when C1 binds to 1234 it’ll be reachable through the gluetun service.

Note: as mentioned if C1 and C2 cannot use the same port if you also want to have service gluetun set. More likely than not you start C1, it binds to the port, start C2, it tries and fails to bind to the port and crashes. I fixed this by making one of my jellyfin containers use a separate port. If you can’t configure the ports of your services then there’s no real recourse FWIU.

If you want a richer login authelia + caddy is good.

I use docker so don’t really have to worry about reproducibility of the Services or configurations. Docker will fetch the right services and versions. I’ve documented the core configurations so I can set them back up relatively easily. Anything custom I haven’t documented I’ll just have to remember or find I need to reset up.

In general yes. You can think of each container in a docker network as a host and docker makes these hosts discoverable to each other. Docker also supports some other network types that may not follow this concept if you configure them as such (for example if you force all containers to use the same networking stack as one container (I do this with gluetun so I can run everything in a vpn) all services will be reachable only from the gluetun host instead of individual service hosts).

Furthermore services in a container are not exposed outside of it by default. You must explicitly state when a port in a container is reachable by your host (the ports: option).

But getting back to the question at hand, what you’re looking for is a reverse proxy. It’s a program that accepts requests from multiple requested and forwards them somewhere else. So you connect to the proxy and it can tell based on how you connect (the url) whether to send the request to sonarr or radarr. http://sonarr.localhost and http://radarr.localhost will both route to your proxy and the proxy will pass them to the respective services based on how you configure it. For this you can use nginx, but I’d recommend caddy as it’s what I’m using and it makes setting up things like this such a breeze.

I have the utmost respect and appreciation for mullvad but I don’t need a vpn without port forwarding so I cancelled my sub. They are still objectively the vest vpn, this is the only sticking point.