LinusandClaude Opus 5.5
f01fe47f16
Dockerfile installs Claude Desktop from Anthropic's apt repo (key fingerprint verified) and runs it as a non-root user matching the host UID/GID. run.sh forwards the host X display with a scoped xauth cookie and checks that a window can be drawn before starting the app. No keyring and no config volume: Electron uses --password-store=basic, the container runs with --rm, so the user logs in on every start. Chromium's sandbox can't create namespaces under Docker's default seccomp profile, so the app runs with --no-sandbox; the container's own seccomp and namespaces remain the boundary to the host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>