From baa4d9ea03f3405c2786c26a0a662e959872741a Mon Sep 17 00:00:00 2001
From: Nicholas Ward <nicholaspward@outlook.com>
Date: Tue, 29 Jul 2025 19:25:24 -0500
Subject: [PATCH] use new token name for clarity; use unprivileged image base

---
 .gitea/workflows/build-and-push-image.yml |  2 +-
 container/Dockerfile                      | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/build-and-push-image.yml b/.gitea/workflows/build-and-push-image.yml
index d62987c..ff5af0b 100644
--- a/.gitea/workflows/build-and-push-image.yml
+++ b/.gitea/workflows/build-and-push-image.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           registry: ${{ env.IMAGE_REGISTRY }}
           username: ${{ env.REGISTRY_USERNAME }}
-          password: ${{ secrets.REPO_PKG_TOKEN }}
+          password: ${{ secrets.CD_CD_BUILD_PUSH }}
 
       - name: 🐋 Build Docker image
         run: docker build -t $IMAGE_REGISTRY/$IMAGE_NAME:$IMAGE_TAG ./container
diff --git a/container/Dockerfile b/container/Dockerfile
index b081052..3e61bbc 100644
--- a/container/Dockerfile
+++ b/container/Dockerfile
@@ -1,7 +1,13 @@
-FROM nginx:alpine
+FROM nginxinc/nginx-unprivileged:alpine
+
+USER root
 
 RUN rm -rf /usr/share/nginx/html/*
 
 COPY site/ /usr/share/nginx/html/
 
-EXPOSE 80
+RUN chown -R 101:101 /usr/share/nginx/html
+
+USER 101
+
+EXPOSE 8080