Add permissions.allow to managed-settings.json for Bash(*), Edit(*),
and Write(*). Claude Code will not prompt for confirmation on shell
commands or file writes inside the container.
Add /etc/claude-code/managed-settings.json with availableModels set to
the three Anthropic model families. The file is root-owned inside the
container so the node user cannot modify it. Managed settings cannot be
bypassed via --model flag, /model command, or ANTHROPIC_MODEL env var.