.path unit that watches the certificate, which then starts a corresponding oneshot .service with multiple ExecStart lines
.path unit:
[Unit]
Description=Triggers restart of docker containers when Lets Encrypt certificate is updated
[Path]
PathChanged=/etc/letsencrypt/archive/foobar.example.com/
[Install]
WantedBy=multi-user.target
WantedBy=system-update.target
.service unit:
[Unit]
Description=Restart containers using foobar.example.com certificate
[Service]
Type=oneshot
ExecStart=docker restart foobar
ExecStart=docker restart barbaz
ExecStart=docker restart foobaz