The host-side port mapping and seccomp compatibility-mode selections were only used in-memory for docker run args and never written to config.toml, so a re-run of the installer couldn't recover them as form defaults (worse, the host port field silently defaulted to the container's internal port). Add host_port and seccomp_unconfined to [server] and decode them back via AppConfig. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>