如何在 docker 镜像中安装自签名证书

[SamuNatsu]

使用 docker 进行部署，同时有一个存储需要通过自签名证书访问，尝试替换 entrypoint.sh 运行，但是无法执行 sudo 命令，因为 user 已经被替换成了非特权用户

难道只能改 Dockerfile 了吗？

[lMysticl]

You do not need sudo, and replacing the runtime entrypoint is not the best place to update the trust store. The upstream image deliberately switches to the unprivileged openlist user, so that process cannot modify /etc/ssl/certs.

Create a derived image and use root only during the image build:

FROM openlistteam/openlist:latest

USER root
COPY company-ca.crt /usr/local/share/ca-certificates/company-ca.crt
RUN update-ca-certificates
USER openlist

Build that image and reference it from Compose instead of openlistteam/openlist:latest. The CA file must contain a PEM-encoded certificate and use the .crt extension. For a reproducible deployment, replace latest with the same pinned OpenList tag you currently use.

This preserves the upstream non-root runtime. The OpenList base image already includes ca-certificates, so no sudo or startup-time package installation is required.

References: OpenList creates and selects the unprivileged runtime user, and its base image installs ca-certificates.