Allow for injection of custom certificates inside rootless docker container with .NET application

I'm developing a .NET 6 application that allows the user to configure the integration with an external LDAP, possibly using SSL. I'm trying to setup a container image to distribute the application but I'm having trouble with allowing the user to inject custom certificates inside the running container without using volumes and without root privileges.

As of now I was able to achieve the expect result using volumes and root privileges:

The user needs to map a volume to the /usr/local/share/ca-certificates containing the certificates
before running the application the container runs update-ca-certificates

Is it possible to allow the user to inject/provide custom certificates without using volumes (env vars maybe?) and removing root privileges in the container?

I'm also open to solutions that may imply code development on the .NET application, but from my uderstanding the .NET LDAP implementation simply lets the underlying native library handle the certificate validation. Source

Solution

I was able to achieve what I wanted without modifying any application code:

Define an environment variable containing the certificate $CUSTOM_CERT_1
Use a script as starting command for the container that checks if the variable is defined and if so copy the content to a file (for example /app/certs/custom_cert_1.cer
Execute c_rehash /app/certs since is needed for libldap to work with the custom certificates
export the variable LDAPTLS_CACERTDIR=/app/certs so that the custom certificate is picked up for LDAPS certificate validation
Run my .NET application

This way no volume and no root privileges are needed.

Final startup.sh script example:

#!/bin/sh

mkdir -p /app/certs
found_var=false
for i in $(seq 1 9); do
  var_name="CUSTOM_CERT_$i"
  eval var_value=\$$var_name
  
  if [ ! -z "$var_value" ]; then
    found_var=true
    echo "$var_value" > /app/certs/custom_cert_$i.cer
  fi
done

if [ "$found_var" = true ]; then
  c_rehash /app/certs
  export LDAPTLS_CACERTDIR=/app/certs
fi

dotnet MyApp.dll