What is the best way to open my docker to the internet for streaming? I know about tunnelling but its against TOS for cloudfare.

Dockers of SWAG or nginx-proxy-manager will do it. Both are reverse proxies and can use lets encrypt ssl certificates. nginx-proxy-manager is easier to configure the access in as it uses a browser accessible GUI instead of having to write config files like SWAG, but SWAG will give some additional features like fail2ban and possibly load balancing if required. In each case you will need port 80 and 443 open on your router (80 is required for unencrypted access and for negotiating ssl certificates, 443 is used for encrypted/https access, you can configure to have all accessed forced to switch to 443), but the reverse proxy can then route all access to the correct docker by using sub-domains, like calibre.your-domain.com and jellyfin.your-domain.com routed to the port used by the docker container.

https://hub.docker.com/r/linuxserver/swag

https://hub.docker.com/r/jc21/nginx-proxy-manager

https://hub.docker.com/r/jlesage/nginx-proxy-manager

I am currently using the jlesage/nginx-proxy-manager because I has some issues setting up the jc21 container several years ago on an older omv version when I was starting to explore docker and have just kept using it, but either version should work. I will probably be switching to SWAG on one of the servers I look after at some point in the near future for the load balancing on a potential high availability setup I want to attempt, so I will have to start learning some nginx config file setup.

If you are not familiar or comfortable with config file editing I would suggest you start with nginx-proxy-manager for it's easier configuration.