> - For dynamic sits, the container should run a HTTP server that serves
>    the site. Nginx reverse proxy can map the in-container server's port
>    to some URL that is visible to the web-browsing public.

I wasn't thinking straight; a two-step solution is needed here. First, a
build container builds the server program and outputs the executable and
supporting files as a tar archive. (Just as for static sites.) That tar
file contains another Containerfile. That second Containerfile runs the
actual server program.