[checker]

Yeah containers are the way to go. Run a sidecar proxy such as Envoy and you can offload the TLS at the proxy so you don't have to write any TLS code yourself.