Docker Entrypoint Script Root Permission

I have a Dockerfile that has 3 constraints:

1.) The final USER statement in the Dockerfile must be USER tomcat for security purposes (it is built off the tomcat:8.5.23-jre8-alpine image)

2.) It cannot run chmod on the /root/ directory or the $JAVA_HOME

3.) It must be able to modify the $JAVA_HOME/lib/security directory within the entrypoint and not in the Dockerfile (as certificates are passed in on container startup)

As of now I have

FROM tomcat:8.5.23-jre8-alpine

#### OTHER IMAGE COMMANDS ####

COPY ./entrypoint.sh /usr/local/bin/entrypoint.sh

RUN chown root:root /usr/local/bin/entrypoint.sh

RUN chmod 4755 /usr/local/bin/entrypoint.sh

USER tomcat

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["catalina.sh", "run"]

I figured giving ownership of the file to root and chmod 4755 would allow the tomcat user to execute the entrypoint, but have entrypoint run as root so that it could modify the file system as it would like to. However, when I run this line in the entrypoint

$JAVA_HOME/bin/keytool -import -alias ca_local -keystore $JAVA_HOME/lib/security/cacerts -storepass XXXXX -noprompt -trustcacerts -file /usr/local/tomcat/certificates/ca-local.cer

I get the following error:

keytool error: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8-openjdk/jre/lib/security/cacerts (Permission denied)