A lot of different fixes. What I have in production right now.

Run as a limited user and bind to the regular HTTP port using file
capabilities.

- Use port 8080 (http-alt) instead of port 80 (a priviliged port).
- Run Apache with the www-data user.
- Enable the Apache status module.

Instead of a persistent volume with the configuration, use environment
variables.

- Use a patch to change the configuration files (instead of fiddling
with sed).
- Don't log the healthcheck requests.