TLS certificate with hardcoded private key in postgres Docker Hub image

I checked a couple of top images on Docker Hub for pregenerated / hardcoded private keys and noted that the "postgres" images (which is a "Docker Official Image") contain a pregenerated "snakeoil" certificate and private key:

/etc/ssl/private/ssl-cert-snakeoil.key
/etc/ssl/certs/ssl-cert-snakeoil.pem

Those snakeoil certs are autogenerated by Debian, but they are not supposed to be hardcoded. Instead, keys should be generated
on instantiating a container from an image.

The security risk is somewhat limited, as the postgres image does not appear to directly enable TLS, so the certificate is not used in the default configuration. It is however referenced in the config file postgresql-common/root.crt, so it looks like it could easily get enabled and used.

(I reported this to Docker's security contact, but was asked to report it here due to the low security risk. More generally, I think it's worth considering having some safeguards against this for all Docker images, e.g., by auto-scanning them for common pregenerated key paths. But not sure if this is the right place to discuss this.)

Start by inspecting the image build for how /etc/ssl/private/ssl-cert-snakeoil.key, /etc/ssl/certs/ssl-cert-snakeoil.pem, and postgresql-common/root.crt enter the image. Check whether the private key is present in the built image and determine a safe initialization-time approach; done means no pregenerated private key is shipped while the default PostgreSQL image behavior remains unchanged.