Old container images can break TLS connections to other services.
The container reports healthy yet fails when the application reaches out to a dependent service over TLS. Health checks commonly stay inside the container or hit a local endpoint that skips certificate validation entirely.
The error message states an unknown authority or reports a certificate path building failure. The TLS client cannot construct a chain from the roots present in its trust store to the certificate presented by the remote service.
Look at the image build date early. The CA bundle inside the image matches the set of root certificates that existed when the base layers were created.
Root certificates change over time. Certificate authorities publish new roots and retire older ones after they expire. The container carries forward only the bundle that was included at build time.
Pinning the base image to a digest locks the filesystem content from that earlier point. No later root updates reach the container until someone rebuilds the image.
Rebuild against a current base image and ensure the ca-certificates package is present and up to date in the final layers. Deploy the new image and test the outbound TLS call directly.
The same remote service that previously failed now succeeds. The certificate chain it presents matches a root the rebuilt container trusts. This approach rules out the external service as the source of the problem before other changes are considered.