feat: use nginx-unprivileged image for container security

Cherry-picked from upstream PR CorentinTh#1499 (ombre8):
- Switch to nginxinc/nginx-unprivileged (runs as non-root user)
- Listen on port 8080 instead of 80
- Combined with PR CorentinTh#1796: pinned to 1.31-alpine for CVE-2026-42945 fix
- Update README docker run examples

Author: kxhubs

Dockerfile

@@ -10,8 +10,8 @@ COPY . .
 RUN pnpm build
 
 # production stage
-FROM nginx:1.31-alpine AS production-stage
+FROM nginxinc/nginx-unprivileged:1.31-alpine AS production-stage
 COPY --from=build-stage /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-EXPOSE 80
+EXPOSE 8080
 CMD ["nginx", "-g", "daemon off;"]

README.md

@@ -21,13 +21,13 @@ Self host solutions for your homelab
 **From docker hub:**
 
 ```sh
-docker run -d --name it-tools --restart unless-stopped -p 8080:80 corentinth/it-tools:latest
+docker run -d --name it-tools --restart unless-stopped -p 8080:8080 corentinth/it-tools:latest
 ```
 
 **From github packages:**
 
 ```sh
-docker run -d --name it-tools --restart unless-stopped -p 8080:80 ghcr.io/corentinth/it-tools:latest
+docker run -d --name it-tools --restart unless-stopped -p 8080:8080 ghcr.io/corentinth/it-tools:latest
 ```
 
 **Other solutions:**

nginx.conf

@@ -1,10 +1,10 @@
 server {
-    listen 80;
+    listen 8080;
     server_name localhost;
     root /usr/share/nginx/html;
     index index.html;
 
     location / {
         try_files $uri $uri/ /index.html;
     }
-}
+}