Think of container as a running VM. Image is the file system of the VM. The image itself is static, so when restarted alll file system changes get tossed out (you can map certain paths inside the container to other storage). A Dockerfile is a file that describes how to build the image (For example : Use an ubuntu base image, run these commands, copy this file in to this path, expose this network port, and when running the container, start this file when it boots up).
When running a container you specify which image it should run, network ports to expose to the host network, environment variables that should be set inside the container, if it has access to a gpu, mapping paths to storage and so on. You can even change the startup command.
A docker compose file is a config file that can define all those things, and define it for multiple containers, binding them together in one stack. So you could for example have a static web server, an api server, a database server, redis, and so on defined and configured via environment variables. And you could just do "docker compose up" to bring up all the parts in their own docker namespace and virtual network.
Use a proxy in front of them, and let that deal with the certificate. Traefik is relatively easy to set up for that, but you can also use others, like f.ex nginx or haproxy.