Run nginx as the frigate user with writable state in /tmp/nginx

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -1,9 +1,15 @@
+# Copied to /tmp/nginx/conf at startup and loaded with -c from there. Relative
+# includes resolve against the -c file, but every other path directive resolves
+# against the compile-time --prefix, so non-include paths must stay absolute.
+
 daemon off;
+# Ignored by a non-root master; required by FRIGATE_RUN_AS_ROOT so workers
+# stay root instead of the compiled-in default user
 user root;
 worker_processes auto;
 
 error_log /dev/stdout warn;
-pid /var/run/nginx.pid;
+pid /tmp/nginx/nginx.pid;
 
 events {
     worker_connections 1024;
@@ -13,6 +19,12 @@ http {
     map_hash_bucket_size 256;
     server_tokens off;
 
+    client_body_temp_path /tmp/nginx/client_body;
+    proxy_temp_path /tmp/nginx/proxy;
+    fastcgi_temp_path /tmp/nginx/fastcgi;
+    uwsgi_temp_path /tmp/nginx/uwsgi;
+    scgi_temp_path /tmp/nginx/scgi;
+
     include mime.types;
     default_type application/octet-stream;