use new token name for clarity; use unprivileged image base

.gitea/workflows/build-and-push-image.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           registry: ${{ env.IMAGE_REGISTRY }}
           username: ${{ env.REGISTRY_USERNAME }}
-          password: ${{ secrets.REPO_PKG_TOKEN }}
+          password: ${{ secrets.CD_CD_BUILD_PUSH }}
 
       - name: 🐋 Build Docker image
         run: docker build -t $IMAGE_REGISTRY/$IMAGE_NAME:$IMAGE_TAG ./container

container/Dockerfile

@@ -1,7 +1,13 @@
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
+
+USER root
 
 RUN rm -rf /usr/share/nginx/html/*
 
 COPY site/ /usr/share/nginx/html/
 
-EXPOSE 80
+RUN chown -R 101:101 /usr/share/nginx/html
+
+USER 101
+
+EXPOSE 8080