Add Ghidra 12.2 and start it alongside Claude Desktop

Install Ghidra 12.2 from the official GitHub release into /opt/ghidra,
verified against the SHA-256 in the release notes, with Ubuntu's
openjdk-25-jdk (Ghidra 12.2 requires Java 25). Version, build date and
hash are build args.

The entrypoint, renamed from launch-claude.sh to launch-apps.sh, now
starts both apps and stops both, ending the container, when either is
closed: Ghidra when its process exits (closing the project window),
Claude Desktop when none of its windows is open or minimized. Claude is
stopped via its main process so it can shut down its own helpers.

CLAUDE.md now records that Claude Desktop and Ghidra share one
container, at the user's request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -33,6 +33,25 @@ RUN apt-get update \
         fonts-dejavu-core \
  && rm -rf /var/lib/apt/lists/*
 
+# Ghidra from the official GitHub release, checked against the SHA-256 in the
+# release notes: https://github.com/NationalSecurityAgency/ghidra/releases
+# Ghidra 12.2 needs JDK 25 (application.java.min=25). The full JDK, not the
+# headless one, because Ghidra's GUI needs the AWT/X11 libraries.
+ARG GHIDRA_VERSION=12.2
+ARG GHIDRA_BUILD_DATE=20261016
+ARG GHIDRA_SHA256=2c2cd776db3c1f6a097ba418922378ac3649cadd5e844a6f5f088ae628a7be67
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends openjdk-25-jdk unzip \
+ && rm -rf /var/lib/apt/lists/* \
+ && curl -fsSLo /tmp/ghidra.zip \
+        "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_${GHIDRA_VERSION}_build/ghidra_${GHIDRA_VERSION}_PUBLIC_${GHIDRA_BUILD_DATE}.zip" \
+ && echo "${GHIDRA_SHA256}  /tmp/ghidra.zip" | sha256sum -c - \
+ && unzip -q /tmp/ghidra.zip -d /opt \
+ && rm /tmp/ghidra.zip \
+ && ln -s "/opt/ghidra_${GHIDRA_VERSION}_PUBLIC" /opt/ghidra \
+ && ln -s /opt/ghidra/ghidraRun /usr/local/bin/ghidra
+ENV GHIDRA_INSTALL_DIR=/opt/ghidra
+
 # Ubuntu 24.04 ships a default "ubuntu" user on UID 1000; replace it.
 RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
  && groupadd -g "${USER_GID}" "${USER_NAME}" \
@@ -40,16 +59,17 @@ RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
  && install -d -o "${USER_UID}" -g "${USER_GID}" /workspace \
  && ln -s /workspace "/home/${USER_NAME}/workspace"
 
-COPY --chmod=755 launch-claude.sh /usr/local/bin/launch-claude
+COPY --chmod=755 launch-apps.sh /usr/local/bin/launch-apps
 
 USER ${USER_NAME}
 WORKDIR /home/${USER_NAME}
 
-# launch-claude quits the app (and so the container) when its window closes.
+# launch-apps starts Claude Desktop and Ghidra and stops both (and so the
+# container) when either one is closed.
 # No keyring: tell Electron not to look for one. Session data lives only in
 # the container's filesystem, which is discarded on exit (run with --rm), so
 # the user signs in on every start.
 # --no-sandbox: Docker's default seccomp profile blocks the namespaces
 # Chromium's sandbox needs, so the zygote dies on start. The container's own
 # seccomp/namespaces stay in place as the boundary to the host instead.
-CMD ["launch-claude", "--password-store=basic", "--no-sandbox"]
+CMD ["launch-apps", "--password-store=basic", "--no-sandbox"]