Not every container is a ssl producer, some 'consumers' only need the root.crt to connect to a service and not every 'producer' needs to connect to another producer, but some do.
Example:
consumer:
volume:
- nodepki-root:/certs/root
producer:
volume:
- nodepki-root:/certs/root
- nodepki-producer:/certs/producer