Only the 8084 forward is exposed; the desktop GUI runs inside the container netns and is internal-only. Drop the now-unneeded CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns).