Enhance documentation on default configurations to emphasize security practices of running containers as non-root users. Added sections on implications for web server ports and file permissions, along with recommended methods for running services on standard HTTP/HTTPS ports.

Author: jaydrogers

docs/content/docs/1.getting-started/5.default-configurations.md

@@ -12,13 +12,21 @@ layout: docs
 All values are defaulted to improve security and performance. We also spent the time to carefully review official documentation and include packages that are required specifically for Laravel and WordPress.
 
 ## Unprivileged by Default
-All images default to running as the OS-native `www-data` user.
 
-::note
-The `www-data` UID/GID is different between Debian (`33:33`) and Alpine (`82:82`). We left these values alone to make these images as native as possible. If you switch between Debian and Alpine, you may need to adjust file permissions in your Docker image and volume mounts.
-::
+All images default to running as the OS-native `www-data` user instead of `root`. This is a critical security practice that limits what an attacker can do if they compromise your container.
+
+### Why this matters
+Running as a non-root user means:
+
+- **Better security**: If someone exploits a vulnerability in your app, they can't gain root access to your container or host system
+- **Production-ready**: This follows Docker and Kubernetes security best practices
+- **Easier compliance**: Many security policies require non-root containers
 
-Since these images are not privileged, that means they are not running on ports less than 1024:
+### What this means for you
+Running unprivileged has two practical implications you should know about:
+
+#### Different ports for web servers
+On Linux systems, only root can bind to ports below 1024 (like 80 and 443). Since our containers don't run as root, they use higher port numbers by default:
 
 | **Variation** | **Default Ports** |
 |---------------|-------------------|
@@ -29,15 +37,35 @@ Since these images are not privileged, that means they are not running on ports
 | unit | HTTP: 8080, HTTPS: 8443 |
 | frankenphp | HTTP: 8080, HTTPS: 8443 |
 
-### How do I run these services on ports 80 and/or 443?
-Almost everyone will want to run these services on ports 80 and 443. If you have an advanced setup, you can use a reverse proxy like Caddy or Traefik to handle the SSL termination and forward the traffic to the container on the non-privileged port.
+#### File permissions to be aware of
+The `www-data` user has different IDs depending on your base operating system:
+- **Debian**: UID/GID `33:33`
+- **Alpine**: UID/GID `82:82`
+
+::tip
+We kept these as the OS defaults to maintain compatibility with other tools and images. If you're mounting volumes from your host machine or switching between Debian and Alpine, you might need to adjust file permissions.
+::
+
+### Running on standard HTTP/HTTPS ports (80 and 443)
+Don't worry—you have two easy options to run your app on the standard web ports:
 
-Or you can simply use Docker's port mapping feature to map the container port to the host port. For example, to run the `fpm-nginx` variation on port 80 and 443, you can run the following command:
+#### Docker port mapping (recommended for development)
+Use Docker's built-in port mapping to route traffic from port 80/443 on your host to the container's higher ports:
 
 ```bash [Terminal]
 docker run -p 80:8080 -p 443:8443 serversideup/php:8.4-fpm-nginx
 ```
 
+This tells Docker: "Take traffic coming to port 80 on my machine and send it to port 8080 in the container."
+
+#### Reverse proxy (recommended for production)
+Use a reverse proxy like [Caddy](https://caddyserver.com/){target="_blank"}, [Traefik](https://traefik.io/){target="_blank"}, or [NGINX](https://nginx.org/){target="_blank"} to handle SSL certificates and route traffic to your containers. This is the preferred approach for production because it:
+- Automatically handles SSL certificate generation and renewal
+- Can route to multiple containers/services
+- Provides additional security features like rate limiting
+
+:u-button{to="/docs/deployment-and-production/configuring-ssl" label="Learn about SSL configuration" aria-label="Learn about SSL configuration" size="md" color="primary" variant="outline"  trailing-icon="i-lucide-arrow-right" class="font-bold ring ring-inset ring-blue-600 text-blue-600 hover:ring-blue-500 hover:text-blue-500"}
+
 ## Default Environment Variables
 Environment variables give you a ton of flexibility to customize your container without the complexity of mounting custom configuration files. By default, these images are set to production-ready values. You can read more about the available environment variables below.