title: How to add a custom CA-Certificate on an extended (node.js) docker image
body: <p>I'm extending the <a href="https://hub.docker.com/r/nodered/node-red-docker/" rel="nofollow noreferrer">node-red docker</a> image which (currently) bases itself on the <code>node:6</code>docker image. </p>
  
  <p>I would like to add a custom SSL-Certificate into the docker-image's certificate store. Up to now I did this as follow: </p>
  
  <pre><code>FROM nodered/node-red-docker
  
  ADD DigiCertCA.crt /usr/local/share/ca-certificates/
  RUN update-ca-certificates
  
  ADD settings.js /data/settings.js
  
  RUN npm install node-red-contrib-ttn
  RUN npm install node-red-contrib-influxdb
  RUN npm install node-red-admin
  RUN npm install node-red-node-geohash 
  
  CMD ["npm", "start", "--", "--userDir", "/data"]
  </code></pre>
  
  <p>Building this image fails, because the <code>RUN</code> is executed as non-root user <code>node</code>. </p>
  
  <pre><code>Updating certificates in /etc/ssl/certs... ln: failed to create symbolic link '/etc/ssl/certs/DigiCertCA.pem': Permission denied
  The command '/bin/sh -c update-ca-certificates' returned a non-zero code: 1
  </code></pre>
  
  <p>I'm aware that as non-root such an operation is not possible. But what's the valid concept to extend existing images with custom CA-Certificates?</p>