diff --git a/README.md b/README.md
index 86186d9..158e90c 100644
--- a/README.md
+++ b/README.md
@@ -7,29 +7,22 @@ A self-hosted, web-based AI photo editor. Paint over any object, describe what y
 ### GPU machine (recommended — free inference, best quality)
 
 ```bash
-# Prerequisites: Docker + nvidia-container-toolkit
-# Install toolkit once (Ubuntu/Debian):
-curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
-  | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-ctk.gpg
-curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \
-  | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-ctk.gpg] https://#g' \
-  | sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
-sudo apt-get update && sudo apt-get install -y nvidia-container-toolkit
-sudo nvidia-ctk runtime configure --runtime=docker
-sudo systemctl restart docker
-
-# Verify GPU passes through into Docker:
-docker run --rm --gpus all nvidia/cuda:12.1.0-base-ubuntu22.04 nvidia-smi
-
-# Clone and run:
 git clone https://github.com/outis1one/editmaskwithai
 cd editmaskwithai
-docker compose -f docker-compose.gpu.yml up --build
+
+# One-time setup: installs nvidia-container-toolkit, configures Docker,
+# and sets up a permanent DNS fix so the container can download models.
+chmod +x install-local-gpu.sh
+./install-local-gpu.sh
+
+# Start the app (run this each time):
+chmod +x bring-up-local-gpu.sh
+./bring-up-local-gpu.sh
 ```
 
 Open **http://localhost:3080**
 
-**First startup downloads the AI model for your GPU (5–20 GB, one time).** Models are cached in a Docker volume and survive rebuilds.
+**First startup downloads the AI model for your GPU (~13 GB, one time).** Models are cached in `./data/hf_cache/` and survive rebuilds.
 
 ---
 
@@ -52,15 +45,15 @@ Open **http://localhost:3080**
 ```bash
 git pull
 # GPU:
-docker compose -f docker-compose.gpu.yml up -d --build
-# or cloud:
+./bring-up-local-gpu.sh
+# or cloud (no GPU):
 docker compose up -d --build
 ```
 
 If pip packages seem stale after a pull (e.g., wrong diffusers version), force a pip layer rebuild without re-downloading the entire PyTorch base image:
 
 ```bash
-BUILDID=$(date +%s) docker compose -f docker-compose.gpu.yml up -d --build
+BUILDID=$(date +%s) ./bring-up-local-gpu.sh
 ```
 
 ---
@@ -208,32 +201,41 @@ docker compose -f docker-compose.gpu.yml logs | grep -i sam
 
 If Docker created `./data/` as root and you can't write there without `sudo`, you can also use root's curl as above — the container reads the file regardless of owner.
 
-**AI Edit returns "model files not yet downloaded" or "Errno -3 / DNS" error**
+**AI models not downloading (container DNS blocked)**
 
-The container's DNS is blocked (common on corporate networks or custom iptables rules), so it can't download SDXL models from HuggingFace. Two options:
+If you ran `./install-local-gpu.sh`, this is already permanently fixed. Otherwise, the container's host firewall is blocking outbound DNS from the Docker bridge — apply the fix manually (does **not** affect container isolation):
 
-*Option A — fix Docker DNS (recommended, one command):*
 ```bash
 sudo iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT
-docker compose -f docker-compose.gpu.yml restart
+./bring-up-local-gpu.sh
 ```
 
-*Option B — pre-download models on the host (if iptables fix isn't possible):*
+The container will now resolve hostnames and download models automatically (~13 GB on first run, then cached). Watch progress:
 ```bash
-pip install huggingface-hub
-
-# Download the inpainting model (~6.5 GB, needed for AI Edit):
-huggingface-cli download diffusers/stable-diffusion-xl-1.0-inpainting-0.1 \
-  --cache-dir ./data/hf_cache \
-  --exclude "*.msgpack" "flax_*" "tf_*"
-
-# Download the text-to-image model (~6.5 GB, needed for Text → Image):
-huggingface-cli download stabilityai/stable-diffusion-xl-base-1.0 \
-  --cache-dir ./data/hf_cache \
-  --exclude "*.msgpack" "flax_*" "tf_*"
+docker compose -f docker-compose.gpu.yml logs -f | grep -E "local_gpu|Cached|failed"
 ```
 
-The models land in `./data/hf_cache/` which is bind-mounted into the container — no rebuild needed. Restart the container and the first AI Edit request loads from local disk.
+**Alternative: download with a Docker helper container** (no iptables, no host Python needed):
+
+```bash
+# Inpainting model (~6.5 GB) — needed for AI Edit, Make less symmetrical, etc.
+docker run --rm \
+  -v "$(pwd)/data/hf_cache:/root/.cache/huggingface" \
+  python:3.11-slim \
+  bash -c "pip install -q huggingface-hub && \
+    huggingface-cli download diffusers/stable-diffusion-xl-1.0-inpainting-0.1 \
+      --exclude '*.msgpack' 'flax_*' 'tf_*'"
+
+# Text-to-image model (~6.5 GB) — needed for Text → Image
+docker run --rm \
+  -v "$(pwd)/data/hf_cache:/root/.cache/huggingface" \
+  python:3.11-slim \
+  bash -c "pip install -q huggingface-hub && \
+    huggingface-cli download stabilityai/stable-diffusion-xl-base-1.0 \
+      --exclude '*.msgpack' 'flax_*' 'tf_*'"
+```
+
+Then restart: `docker compose -f docker-compose.gpu.yml restart`
 
 **Out of VRAM during generation**
 - Reduce `LOCAL_GPU_MAX_PIPELINES=1` in `.env` (default 2)
diff --git a/bring-up-local-gpu.sh b/bring-up-local-gpu.sh
new file mode 100755
index 0000000..7a13cec
--- /dev/null
+++ b/bring-up-local-gpu.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# bring-up-local-gpu.sh — start the GPU container.
+#
+# Run this each time you want to start the app.
+# Run ./install-local-gpu.sh once first on a new machine.
+#
+# Usage:
+#   ./bring-up-local-gpu.sh              # start (detached, rebuild if needed)
+#   ./bring-up-local-gpu.sh --no-build   # start without rebuilding
+#   ./bring-up-local-gpu.sh down         # stop and remove container
+#   ./bring-up-local-gpu.sh logs -f      # tail logs
+#
+# Force pip layer rebuild (e.g. after requirements change):
+#   BUILDID=$(date +%s) ./bring-up-local-gpu.sh
+
+set -euo pipefail
+
+if [ $# -eq 0 ]; then
+    exec docker compose -f docker-compose.gpu.yml up -d --build
+else
+    exec docker compose -f docker-compose.gpu.yml "$@"
+fi
diff --git a/install-local-gpu.sh b/install-local-gpu.sh
new file mode 100755
index 0000000..814f179
--- /dev/null
+++ b/install-local-gpu.sh
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# install-local-gpu.sh — one-time setup for local GPU inference.
+#
+# Run this once on a new machine. It:
+#   1. Installs the NVIDIA container toolkit (so Docker can use the GPU)
+#   2. Installs a systemd service that permanently fixes Docker container DNS
+#      (allows containers to resolve hostnames — does not touch ufw)
+#   3. Restarts Docker so both changes take effect
+#   4. Verifies the GPU is accessible inside Docker
+#
+# After this, use ./bring-up-local-gpu.sh each time to start the app.
+
+set -euo pipefail
+
+# ── Must run as root (or via sudo) ───────────────────────────────────────────
+if [ "$EUID" -ne 0 ]; then
+    exec sudo bash "$0" "$@"
+fi
+
+echo "=================================================="
+echo "  EditmaskwithAI — Local GPU one-time setup"
+echo "=================================================="
+echo ""
+
+# ── 1. NVIDIA container toolkit ──────────────────────────────────────────────
+if command -v nvidia-ctk &>/dev/null; then
+    echo "✓ nvidia-container-toolkit already installed — skipping"
+else
+    echo "Installing nvidia-container-toolkit..."
+    . /etc/os-release
+    case "$ID" in
+        ubuntu|debian)
+            curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \
+                | gpg --dearmor -o /usr/share/keyrings/nvidia-ctk.gpg
+            curl -fsSL "https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list" \
+                | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-ctk.gpg] https://#g' \
+                | tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
+            apt-get update -qq
+            apt-get install -y nvidia-container-toolkit
+            ;;
+        rhel|fedora|rocky|centos|almalinux)
+            dnf install -y nvidia-container-toolkit
+            ;;
+        *)
+            echo "⚠ Unrecognised distro ($ID). Install nvidia-container-toolkit manually."
+            echo "  See: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html"
+            ;;
+    esac
+fi
+
+nvidia-ctk runtime configure --runtime=docker
+
+# ── 2. Permanent Docker DNS fix via systemd ───────────────────────────────────
+# Adds a rule to the DOCKER-USER iptables chain so containers can resolve
+# hostnames. Runs after docker.service on every boot. Does NOT touch ufw.
+echo ""
+echo "Installing docker-dns-fix systemd service..."
+
+cat > /etc/systemd/system/docker-dns-fix.service << 'EOF'
+[Unit]
+Description=Allow Docker containers to resolve DNS (DOCKER-USER iptables rule)
+After=docker.service
+Requires=docker.service
+BindsTo=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/bin/sh -c \
+  'iptables -C DOCKER-USER -p udp --dport 53 -j ACCEPT 2>/dev/null || \
+   iptables -I DOCKER-USER -p udp --dport 53 -j ACCEPT'
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable docker-dns-fix.service
+echo "✓ docker-dns-fix.service installed and enabled"
+
+# ── 3. Restart Docker ─────────────────────────────────────────────────────────
+echo ""
+echo "Restarting Docker..."
+systemctl restart docker
+sleep 2
+echo "✓ Docker restarted"
+
+# ── 4. Apply DNS rule now (don't wait for next boot) ─────────────────────────
+systemctl start docker-dns-fix.service
+echo "✓ DNS fix applied"
+
+# ── 5. Verify GPU access ─────────────────────────────────────────────────────
+echo ""
+echo "Verifying GPU access inside Docker..."
+if docker run --rm --gpus all nvidia/cuda:12.1.0-base-ubuntu22.04 nvidia-smi &>/dev/null; then
+    echo "✓ GPU is accessible inside Docker"
+else
+    echo "⚠ GPU check failed. Is the NVIDIA driver installed on the host?"
+    echo "  Check: nvidia-smi"
+    echo "  Minimum driver version: 525"
+fi
+
+echo ""
+echo "=================================================="
+echo "  Setup complete."
+echo "  Start the app with:  ./bring-up-local-gpu.sh"
+echo "=================================================="