Add start-gpu.sh: auto-applies iptables DNS fix before container start

The iptables DOCKER-USER rule is lost on reboot; the script re-applies
it each run, checks for duplicates, and is silently skipped on macOS/WSL.
Default behaviour (no args): docker compose up -d --build.
All docker compose subcommands can be passed as args (logs, down, etc.).
README Quick Start and Updates sections now reference ./start-gpu.sh.

https://claude.ai/code/session_01WVDg7amsy1TTtxvpku7bcM

start-gpu.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# start-gpu.sh — start the GPU container with Docker DNS fixed.
+#
+# The iptables rule restores Docker's default outbound DNS behaviour.
+# It does NOT affect container isolation (namespaces, filesystems, etc.).
+# The rule is lost on reboot, so this script re-applies it each time.
+#
+# Usage:
+#   ./start-gpu.sh              # start (detached, with build)
+#   ./start-gpu.sh --build      # force rebuild
+#   ./start-gpu.sh logs -f      # tail logs
+#   ./start-gpu.sh down         # stop and remove container
+
+set -euo pipefail
+
+# Apply DNS fix on Linux hosts that have iptables.
+# Skipped silently on macOS and Windows (WSL without iptables).
+if command -v iptables &>/dev/null && command -v sudo &>/dev/null; then
+    if ! sudo iptables -C DOCKER-USER -p udp --dport 53 -j ACCEPT 2>/dev/null; then
+        sudo iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT
+        echo "[start-gpu] Docker DNS fix applied (iptables DOCKER-USER)"
+    else
+        echo "[start-gpu] Docker DNS rule already present — skipping"
+    fi
+fi
+
+# Default: start detached with build. Pass any args to override.
+if [ $# -eq 0 ]; then
+    exec docker compose -f docker-compose.gpu.yml up -d --build
+else
+    exec docker compose -f docker-compose.gpu.yml "$@"
+fi