I get that this sort of MITM often breaks CI pipes, but working with this shouldn't be anything more than a chunk of work involving stuff you ought to be doing

I get that this sort of MITM often breaks CI pipes, but working with this shouldn't be anything more than a chunk of work involving stuff you ought to be doing already, including: 1. put all assets into infrastructure you control, allow pulling only from that infrastructure, no exceptions. 2. understand your containers enough to be able to modify and manage their trusted CA / TLS chains. You really ought to be in a position to manage your supply chain and you really ought to be in a position to manage what your containers trust. Certainly more work and inconvenient, and maybe not practical everywhere, but worth doing even independently of a middleware box, at least once you get to some level of "in production for reals"