Yes, indeed, we were. The docker_manager plugin was loading two JS files in a template using javascript_include_tag, which isn’t aware of DISCOURSE_S3_CDN_URL so it was defaulting to DISCOURSE_CDN_URL and tripping up the CSP.
Should be fixed now via FIX: blank upgrade page when using S3 CDN and CSP · discourse/docker_manager@3d37fd6 · GitHub
@paulrudy if you update the docker_manager plugin, you should no longer need to manually add https://cdn-to-discourse.b-cdn.net/assets/ to your CSP.