Yes, use the "webroot" method of the official Let's Encrypt client.

I see, thanks. I use the docker container "version", so I assume I have to somehow mount a volume to the container, that's also accessible from my nginx ( or whatever ) container, so it can serve the static file LE creates. Is there something more to it?

sure - run the renewal from a different server

You can do it on the same server without downtime by using the "webroot" method of the LE client.