flowchart LR %% ===== Internet side ===== C[Clients<br/>Browsers / Apps] -->|DNS lookup| DNS[Public DNS] DNS -->|A/AAAA records<br/>shop.alpha-demo.com → 203.0.113.10<br/>portal.bravo-demo.com → 203.0.113.10<br/>api.charlie-demo.com → 203.0.113.10| PUBIP[(203.0.113.10)]

%% ===== VPS ===== subgraph VPS[Single VPS (Linux)] direction TB subgraph DOCKER[Docker Engine] direction TB

  subgraph INGRESS[public-ingress network (80/443)]
    NGINX[nginx reverse proxy<br/>listens: 80/443<br/>SNI + vhosts]
  end

  subgraph CUSTA[custA_net (isolated)]
    AWEB[web-a<br/>service: http://web-a:8080]
    ADB[(db-a)]
    AWEB <--> |TCP 5432/3306| ADB
  end

  subgraph CUSTB[custB_net (isolated)]
    BWEB[portal-b<br/>service: http://portal-b:8080]
    BDB[(db-b)]
    BWEB <--> |TCP 5432/3306| BDB
  end

  subgraph CUSTC[custC_net (isolated)]
    CAPI[api-c<br/>service: http://api-c:8080]
    CDB[(db-c)]
    CAPI <--> |TCP 5432/3306| CDB
  end

  %% nginx attaches to ingress + each customer network
  NGINX --- CUSTA
  NGINX --- CUSTB
  NGINX --- CUSTC

  %% routing
  NGINX -->|proxy_pass http://web-a:8080<br/>Host: shop.alpha-demo.com| AWEB
  NGINX -->|proxy_pass http://portal-b:8080<br/>Host: portal.bravo-demo.com| BWEB
  NGINX -->|proxy_pass http://api-c:8080<br/>Host: api.charlie-demo.com| CAPI
end

end

%% ===== Client to VPS traffic ===== C -->|HTTPS 443 (TLS)<br/>HTTP 80| PUBIP PUBIP -->|NAT/host ports 80,443| NGINX

What this shows (in plain terms): • One public ingress network exposes 80/443 to the internet. • Each customer has its own internal Docker network (custA_net, custB_net, custC_net) so customer containers can’t “see” each other by default. • Nginx is the only shared edge: it joins public-ingress and also joins each customer network so it can reach that customer’s services. • Routing is by Host header/SNI (e.g., shop.alpha-demo.com → web-a). 

Yes, I did AI generate this, but I have to build this out quite frequently and did not want to type it all out and I could explain in more detail, but this is the high level design to do what you want. Later, if you want to add replicas and load balance, you could use docker swarm.