If you use containers with health checks (including with curl), you need to tell docker (or podman) to provide an init process to reap child processes. For docker that means providing --init when running a container. It’s a pretty common problem.

Historical reasons I believe and also because packages are signed. Though there’s been a few vulnerabilities that have made TLS (IMHO) a necessity. As well as just preventing snooping. Modern debian and apt should support TLS out of the box now.

Unlikely to be the problem, but I’d switch the config to use https URLs.