Ask for the model provider on every start

run.sh shows a window (zenity form, terminal prompts without zenity) for
a base URL, token, auth header and optional model list. Left empty,
Claude Desktop starts normally with the claude.ai sign-in. Otherwise it
runs in its third-party gateway mode: run.sh writes the managed config
(inferenceProvider "gateway" and friends) and copies it into the created
container as root, because Claude Desktop ignores
/etc/claude-desktop/managed-settings.json unless root owns it. The host
copy is deleted right away; nothing is kept between starts.

Claude Desktop only allows plain http to loopback, so for an http://
gateway launch-apps.sh runs socat on 127.0.0.1:18080 and forwards to it.
localhost is rewritten to host.docker.internal for servers on the host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -177,6 +177,7 @@ RUN apt-get update \
         claude-desktop \
         x11-utils \
         xauth \
+        socat \
         fonts-dejavu-core \
  && rm -rf /var/lib/apt/lists/*
 
@@ -393,6 +394,11 @@ RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
 COPY --chown=${USER_UID}:${USER_GID} ghidra/FrontEndTool.xml ghidra/preferences \
      /home/${USER_NAME}/.config/ghidra/ghidra_${GHIDRA_VERSION}_PUBLIC/
 
+# Claude Desktop's managed configuration directory. run.sh copies a
+# managed-settings.json in (root-owned, as Claude Desktop requires) when a
+# third-party model provider is chosen at start.
+RUN install -d -m 755 /etc/claude-desktop
+
 # Claude Desktop's MCP servers. Only this file is put in ~/.config/Claude;
 # sign-in data is still created at runtime and discarded with the container.
 COPY --chown=${USER_UID}:${USER_GID} claude-desktop/claude_desktop_config.json \