Share a chosen workspace folder and stop with the window

run.sh asks which host folder Claude may access, using the desktop's
folder picker (zenity, or kdialog on KDE; terminal prompt otherwise),
and mounts it read-write at /workspace. It opens at the last folder
used, refuses / and $HOME, and can be skipped with --workspace DIR.
The image creates /workspace and a ~/workspace symlink to it.

Closing Claude Desktop's window only hides the app, which left the
container running invisibly. The new entrypoint launch-claude.sh
watches the app's X windows and quits it once none is open or
minimized, so the container exits with it. run.sh adds --init for
signal handling and reaping.

Also add .gitignore for workspace/ and .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -36,15 +36,20 @@ RUN apt-get update \
 # Ubuntu 24.04 ships a default "ubuntu" user on UID 1000; replace it.
 RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
  && groupadd -g "${USER_GID}" "${USER_NAME}" \
- && useradd -m -u "${USER_UID}" -g "${USER_GID}" -s /bin/bash "${USER_NAME}"
+ && useradd -m -u "${USER_UID}" -g "${USER_GID}" -s /bin/bash "${USER_NAME}" \
+ && install -d -o "${USER_UID}" -g "${USER_GID}" /workspace \
+ && ln -s /workspace "/home/${USER_NAME}/workspace"
+
+COPY --chmod=755 launch-claude.sh /usr/local/bin/launch-claude
 
 USER ${USER_NAME}
 WORKDIR /home/${USER_NAME}
 
+# launch-claude quits the app (and so the container) when its window closes.
 # No keyring: tell Electron not to look for one. Session data lives only in
 # the container's filesystem, which is discarded on exit (run with --rm), so
 # the user signs in on every start.
 # --no-sandbox: Docker's default seccomp profile blocks the namespaces
 # Chromium's sandbox needs, so the zygote dies on start. The container's own
 # seccomp/namespaces stay in place as the boundary to the host instead.
-CMD ["claude-desktop", "--password-store=basic", "--no-sandbox"]
+CMD ["launch-claude", "--password-store=basic", "--no-sandbox"]