If the container boundary is meaningful, you can do things like run TLS termination in a container (because OpenSSL is a quagmire), and connect to the server via unix socket. Then the container has no need for outgoing network sockets, and limited filesystem access.

Of course, if the container boundary isn't meaningful, you've complicated your system design for nothing.

And either way, TLS termination in a separate process is a potentially significant penalty to performance, as you'll have a lot more copies.