Pod Security restricted: what broke for us

Switching the namespace to restricted rejected our nginx router: it starts as root to bind port 80 and adds CHOWN, SETGID and SETUID. Moving to an unprivileged port fixed most of it.