I need to fetch a certificate and update my CAs when my dockerfile starts.

As such, I need USER root in there.

However, I want the rest of my application to run under app.

Is there any way to drop root perms in a way that app can’t just exit and get back to root the way putting su - app in my entrypoint script would allow?