"The CentOS managed base image uses `yum` and `rpm` for package management, and these pull RPM files only over HTTPS connections."

That's interesting. Is there a reason for that?

IIRC the stock CentOS doesn't use HTTPS for its yum/rpm repos and I figured it wasn't necessary to use HTTPS since the package signature is verified.