I think you can send a SIGUSR1 signal to mumble process to tell it to reload the ssl certificate without actually restarting mumble's process. You can use docker kill --signal="SIGUSR1" <container name or id>, but then you still need to give your user access to docker group. Maybe you can setup a monthly cron on root user to run that command every months?