From 7cfbb6034f5b77627dbe2a54fea2eb7d4e63cf54 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 14 Jun 2026 00:58:43 +0000
Subject: [PATCH] Add start-gpu.sh: auto-applies iptables DNS fix before
 container start

The iptables DOCKER-USER rule is lost on reboot; the script re-applies
it each run, checks for duplicates, and is silently skipped on macOS/WSL.
Default behaviour (no args): docker compose up -d --build.
All docker compose subcommands can be passed as args (logs, down, etc.).
README Quick Start and Updates sections now reference ./start-gpu.sh.

https://claude.ai/code/session_01WVDg7amsy1TTtxvpku7bcM
---
 README.md    |  9 +++++----
 start-gpu.sh | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100755 start-gpu.sh

diff --git a/README.md b/README.md
index 7a05e13..99ca583 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,8 @@ docker run --rm --gpus all nvidia/cuda:12.1.0-base-ubuntu22.04 nvidia-smi
 # Clone and run:
 git clone https://github.com/outis1one/editmaskwithai
 cd editmaskwithai
-docker compose -f docker-compose.gpu.yml up --build
+chmod +x start-gpu.sh
+./start-gpu.sh
 ```
 
 Open **http://localhost:3080**
@@ -52,15 +53,15 @@ Open **http://localhost:3080**
 ```bash
 git pull
 # GPU:
-docker compose -f docker-compose.gpu.yml up -d --build
-# or cloud:
+./start-gpu.sh          # applies DNS fix then rebuilds + starts
+# or cloud (no GPU):
 docker compose up -d --build
 ```
 
 If pip packages seem stale after a pull (e.g., wrong diffusers version), force a pip layer rebuild without re-downloading the entire PyTorch base image:
 
 ```bash
-BUILDID=$(date +%s) docker compose -f docker-compose.gpu.yml up -d --build
+BUILDID=$(date +%s) ./start-gpu.sh --build
 ```
 
 ---
diff --git a/start-gpu.sh b/start-gpu.sh
new file mode 100755
index 0000000..bc43b80
--- /dev/null
+++ b/start-gpu.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# start-gpu.sh — start the GPU container with Docker DNS fixed.
+#
+# The iptables rule restores Docker's default outbound DNS behaviour.
+# It does NOT affect container isolation (namespaces, filesystems, etc.).
+# The rule is lost on reboot, so this script re-applies it each time.
+#
+# Usage:
+#   ./start-gpu.sh              # start (detached, with build)
+#   ./start-gpu.sh --build      # force rebuild
+#   ./start-gpu.sh logs -f      # tail logs
+#   ./start-gpu.sh down         # stop and remove container
+
+set -euo pipefail
+
+# Apply DNS fix on Linux hosts that have iptables.
+# Skipped silently on macOS and Windows (WSL without iptables).
+if command -v iptables &>/dev/null && command -v sudo &>/dev/null; then
+    if ! sudo iptables -C DOCKER-USER -p udp --dport 53 -j ACCEPT 2>/dev/null; then
+        sudo iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT
+        echo "[start-gpu] Docker DNS fix applied (iptables DOCKER-USER)"
+    else
+        echo "[start-gpu] Docker DNS rule already present — skipping"
+    fi
+fi
+
+# Default: start detached with build. Pass any args to override.
+if [ $# -eq 0 ]; then
+    exec docker compose -f docker-compose.gpu.yml up -d --build
+else
+    exec docker compose -f docker-compose.gpu.yml "$@"
+fi