FROM mcr.microsoft.com/windows/servercore:1903-amd64 as servercore
RUN certutil -generateSSTFromWU roots.sst

FROM mcr.microsoft.com/powershell:nanoserver-1903

SHELL [ "pwsh", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';" ]

COPY --from=servercore /Windows/System32/certoc.exe /Windows/System32
COPY --from=servercore /roots.sst /

### Begin workaround ###
# Note that changing user on nanoserver is not recommended
# See, https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/container-base-images#base-image-differences
# But we are working around a bug introduced in the nanoserver image introduced in 1809
USER ContainerAdministrator
RUN certoc -addstore -f root /roots.sst