Yes, indeed, we were. The docker_manager plugin was loading two JS files in a template using javascript_include_tag, which isn’t aware of DISCOURSE_S3_CDN_URL so it was defaulting to DISCOURSE_CDN_URL and tripping up the CSP.
Should be fixed now via https://github.com/discourse/docker_manager/commit/3d37fd64ed8acbc415e7d7ad6de4de35bcb060fb
@paulrudy if you update the docker_manager plugin, you should no longer need to manually add https://cdn-to-discourse.b-cdn.net/assets/ to your CSP.