title: Docker Entrypoint Script Root Permission
body: <p>I have a Dockerfile that has 3 constraints:</p>
  
  <p>1.) The final USER statement in the Dockerfile must be <code>USER tomcat</code> for security purposes (it is built off the tomcat:8.5.23-jre8-alpine image)</p>
  
  <p>2.) It cannot run chmod on the <code>/root/</code> directory or the <code>$JAVA_HOME</code></p>
  
  <p>3.) It must be able to modify the <code>$JAVA_HOME/lib/security</code> directory within the entrypoint and not in the Dockerfile (as certificates are passed in on container startup)</p>
  
  <p>As of now I have</p>
  
  <pre><code>FROM tomcat:8.5.23-jre8-alpine
  
  #### OTHER IMAGE COMMANDS ####
  
  COPY ./entrypoint.sh /usr/local/bin/entrypoint.sh
  
  RUN chown root:root /usr/local/bin/entrypoint.sh
  
  RUN chmod 4755 /usr/local/bin/entrypoint.sh
  
  USER tomcat
  
  ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
  CMD ["catalina.sh", "run"]
  </code></pre>
  
  <p>I figured giving ownership of the file to root and chmod 4755 would allow the tomcat user to execute the entrypoint, but have entrypoint run as root so that it could modify the file system as it would like to. However, when I run this line in the entrypoint</p>
  
  <pre><code>$JAVA_HOME/bin/keytool -import -alias ca_local -keystore $JAVA_HOME/lib/security/cacerts -storepass XXXXX -noprompt -trustcacerts -file /usr/local/tomcat/certificates/ca-local.cer
  </code></pre>
  
  <p>I get the following error:</p>
  
  <pre><code>keytool error: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8-openjdk/jre/lib/security/cacerts (Permission denied)
  </code></pre>
  
  <p>It seems the entrypoint isn't actually running as root, as the chown/chmod would have implied. I know that all of my files are in the correct places because when I remove <code>USER tomcat</code> from the Dockerfile everything works fine. What am I missing in setting the permission of the entrypoint?</p>