fix: run the web image unprivileged

SonarCloud raised docker:S6471 on the new stage: nginx:alpine starts its
master process as root. The php-fpm stage next to it deliberately does
not, so this was an inconsistency introduced by the same commit that
added the stage, not a pre-existing trade-off worth accepting.

nginxinc/nginx-unprivileged runs as uid 101 throughout. A port below 1024
needs a capability it does not have, so the server block, EXPOSE, the
healthcheck, the compose port mapping and the README example move to
8080. The pid file already lived in /tmp, so nothing else had to change.

Verified on the built image: id reports uid=101(nginx), every nginx
process runs as nginx, and the two containers together still answer 200
with the real login form while nginx serves /favicon.ico as image/x-icon.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>

Author: CybotTM

Dockerfile

@@ -190,7 +190,11 @@ CMD ["php-fpm", "--nodaemonize"]
 # uses, so the static assets and the PHP that renders around them always
 # come from one build. That is also why the two images MUST be deployed at
 # the same tag: mixing them is mixing two phpMyAdmin versions.
-FROM nginx:1.29-alpine AS web
+# The unprivileged variant rather than nginx:alpine: the stock image runs
+# its master process as root, which the php-fpm stage above deliberately
+# does not, and SonarCloud flags it as docker:S6471. This one runs as uid
+# 101 throughout, which is why the server block listens on 8080.
+FROM nginxinc/nginx-unprivileged:1.29-alpine AS web
 
 ARG PMA_VERSION=5.2.3
 ARG BUILD_DATE
@@ -217,7 +221,7 @@ COPY config/nginx/snippets/ /etc/nginx/snippets/
 # rather than a build-time decision.
 ENV PMA_FPM_UPSTREAM=app:9000
 
-EXPOSE 80
+EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-    CMD ["/bin/sh", "-c", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
+    CMD ["/bin/sh", "-c", "wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1"]

README.md

@@ -50,7 +50,7 @@ PMA_HOST=your-db-host docker compose up -d app-assets app web
 | Image | What it is |
 |---|---|
 | `ghcr.io/netresearch/phpmyadmin-php-fpm` | php-fpm on 9000, serves no HTTP |
-| `ghcr.io/netresearch/phpmyadmin-nginx` | nginx on 80 with the configuration and the document root baked in |
+| `ghcr.io/netresearch/phpmyadmin-nginx` | nginx on 8080 with the configuration and the document root baked in, running as an unprivileged user |
 
 **Deploy both at the same tag.** They share the document root, which is copied
 from one build stage into both, so mixing tags means running two phpMyAdmin
@@ -70,7 +70,7 @@ services:
     environment:
       PMA_FPM_UPSTREAM: pma-fpm:9000
     ports:
-      - "8080:80"
+      - "8080:8080"
 ```
 
 ## Using only the php-fpm image

compose.yml

@@ -94,14 +94,14 @@ services:
     environment:
       PMA_FPM_UPSTREAM: ${PMA_FPM_UPSTREAM:-app:9000}
     ports:
-      - "${PMA_HTTP_PORT:-8080}:80"
+      - "${PMA_HTTP_PORT:-8080}:8080"
     volumes:
       - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./config/nginx/templates:/etc/nginx/templates:ro
       - ./config/nginx/snippets:/etc/nginx/snippets:ro
       - pma-html:/var/www/html:ro
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:8080/"]
       interval: 30s
       timeout: 5s
       retries: 3

config/nginx/templates/default.conf.template

@@ -6,8 +6,10 @@
 # passed through envsubst, which only replaces variables that are actually set
 # in the environment — nginx's own $uri, $document_root and friends survive.
 server {
-    listen 80;
-    listen [::]:80;
+    # 8080, not 80: the image runs as an unprivileged user and a
+    # port below 1024 needs a capability it deliberately does not have.
+    listen 8080;
+    listen [::]:8080;
     server_name _;
 
     root /var/www/html;