Add start-gpu.sh: auto-applies iptables DNS fix before container start

The iptables DOCKER-USER rule is lost on reboot; the script re-applies
it each run, checks for duplicates, and is silently skipped on macOS/WSL.
Default behaviour (no args): docker compose up -d --build.
All docker compose subcommands can be passed as args (logs, down, etc.).
README Quick Start and Updates sections now reference ./start-gpu.sh.

https://claude.ai/code/session_01WVDg7amsy1TTtxvpku7bcM

README.md

@@ -24,7 +24,8 @@ docker run --rm --gpus all nvidia/cuda:12.1.0-base-ubuntu22.04 nvidia-smi
 # Clone and run:
 git clone https://github.com/outis1one/editmaskwithai
 cd editmaskwithai
-docker compose -f docker-compose.gpu.yml up --build
+chmod +x start-gpu.sh
+./start-gpu.sh
 ```
 
 Open **http://localhost:3080**
@@ -52,15 +53,15 @@ Open **http://localhost:3080**
 ```bash
 git pull
 # GPU:
-docker compose -f docker-compose.gpu.yml up -d --build
+./start-gpu.sh          # applies DNS fix then rebuilds + starts
-# or cloud:
+# or cloud (no GPU):
 docker compose up -d --build
 ```
 
 If pip packages seem stale after a pull (e.g., wrong diffusers version), force a pip layer rebuild without re-downloading the entire PyTorch base image:
 
 ```bash
-BUILDID=$(date +%s) docker compose -f docker-compose.gpu.yml up -d --build
+BUILDID=$(date +%s) ./start-gpu.sh --build
 ```
 
 ---

start-gpu.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# start-gpu.sh — start the GPU container with Docker DNS fixed.
+#
+# The iptables rule restores Docker's default outbound DNS behaviour.
+# It does NOT affect container isolation (namespaces, filesystems, etc.).
+# The rule is lost on reboot, so this script re-applies it each time.
+#
+# Usage:
+#   ./start-gpu.sh              # start (detached, with build)
+#   ./start-gpu.sh --build      # force rebuild
+#   ./start-gpu.sh logs -f      # tail logs
+#   ./start-gpu.sh down         # stop and remove container
+
+set -euo pipefail
+
+# Apply DNS fix on Linux hosts that have iptables.
+# Skipped silently on macOS and Windows (WSL without iptables).
+if command -v iptables &>/dev/null && command -v sudo &>/dev/null; then
+    if ! sudo iptables -C DOCKER-USER -p udp --dport 53 -j ACCEPT 2>/dev/null; then
+        sudo iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT
+        echo "[start-gpu] Docker DNS fix applied (iptables DOCKER-USER)"
+    else
+        echo "[start-gpu] Docker DNS rule already present — skipping"
+    fi
+fi
+
+# Default: start detached with build. Pass any args to override.
+if [ $# -eq 0 ]; then
+    exec docker compose -f docker-compose.gpu.yml up -d --build
+else
+    exec docker compose -f docker-compose.gpu.yml "$@"
+fi