One of the traditional ways to do this is to stand up a reverse proxy (e.g. NGinx) That then sits on ports 80 and 443 (you'll want TLS for NextCloud) and forwards traffic to those applications. If you are using docker for everything, you can have a back-end docker network where the NGinx container forwards traffic to the PiHole and NextCloud containers. And since each container is its own entity, you don't need to worry about mucking about with the ports for the different services, they can each have ports 80/443 on their own container and you don't need to worry about forwarding those ports from the host. Though, if PiHole is running on the hardware and not in a container, this can complicate things.