Two containers on the same docker host can talk to each other freely, but the moment they’re on hosts in different locations, that traffic crosses the open internet unprotected. docker-stunnel is a small stunnel wrapper for exactly that gap: run it with -s on the host with the service to protect, run it as a plain client on the other end pointed at that server, and the two docker hosts get an encrypted transport layer between them without touching the containers on either side.