To consistently reproduce (and not rely on mirrorselect), changing the apt source URL to be HTTPS makes it fail all the time.

This is not a bug. By default container images are really minimal, and CA certificates are not installed. Also, by default the Kali images are configured to use HTTP (mirror is http://http.kali.org/kali/).

If you want to use HTTPS you need to install ca-certificates first, before switching your mirror URL to https://....

I cannot install ca-certificates because I cannot apt update. I'm using default mirror http://http.kali.org/kali, but this does automatic mirrorselect.

It is a bug because it happens with the default base image. If you can "force" apt to not select automatically an HTTPS mirror, that would work too. The problem is base image cannot apt update!!

By default you should hit http.kali.org:

┌──(root㉿t14)-[/work]
└─# cat /etc/apt/sources.list.d/kali.sources 
Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg

http.kali.org is a redirector, it redirects you to a HTTP mirror.

However, some mirrors redirect HTTP to HTTPS... And that's the case for kalimirror.velden.media...

I have just disabled this mirror, so it should work now. I'll ping the sysadmin.

Sorry I didn't get what was the issue at first.

Note: you can always edit your APT sources to hit another mirror, eg. kali.download. A one-liner: sed -i 's/http\.kali\.org/kali.download/' /etc/apt/sources.list.d/kali.sources

Thanks, I tried several times, I did not hit an HTTPS mirror anymore. I get kali.download and mirror.init7.net, both working with HTTP. kalimirror.velden.media is not chosen anymore.

Thanks for having reported the issue.