> The ca.crt is there because it triggers desired behavior - e.g. that you can connect to services over SSL without errors. Test that instead. Awesome example

> The ca.crt is there because it triggers desired behavior - e.g. that you can connect to services over SSL without errors. Test that instead. Awesome example here! We have a test that uses container-structure-test to do exactly this over here: https://github.com/GoogleCloudPlatform/distroless/blob/1ea91a52f18cf99cc3f71f55365f6888bb414b05/java/testdata/certs.yaml https://github.com/GoogleCloudPlatform/distroless/blob/1ea91... You can mix and match between tests that check file contents and tests that actually run commands inside the container and make assertions based on their output.