surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| @@ -2,9 +2,8 @@ | ||
| 2 | 2 | set -euo pipefail # Exit on error, undefined vars, and pipeline failures |
| 3 | 3 | IFS=$'\n\t' # Stricter word splitting |
| 4 | 4 | |
| 5 | -# Extract Docker DNS ports before cleanup (for protection) | |
| 6 | -TCP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null | grep 'tcp.*to:127.0.0.11:' | sed 's/.*127\.0\.0\.11://g' | cut -d' ' -f1 || echo "") | |
| 7 | -UDP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null | grep 'udp.*to:127.0.0.11:' | sed 's/.*127\.0\.0\.11://g' | cut -d' ' -f1 || echo "") | |
| 5 | +# 1. Extract Docker DNS info BEFORE any flushing | |
| 6 | +DOCKER_DNS_RULES=$(iptables-save -t nat | grep "127\.0\.0\.11") | |
| 8 | 7 | |
| 9 | 8 | # Flush existing rules and delete existing ipsets |
| 10 | 9 | iptables -F |
| @@ -15,17 +14,14 @@ | ||
| 15 | 14 | iptables -t mangle -X |
| 16 | 15 | ipset destroy allowed-domains 2>/dev/null || true |
| 17 | 16 | |
| 18 | -# Restore Docker DNS NAT rules if they existed | |
| 19 | -if [ -n "$TCP_PORT" ] && [ -n "$UDP_PORT" ]; then | |
| 20 | - echo "Restoring Docker DNS with TCP:$TCP_PORT, UDP:$UDP_PORT" | |
| 21 | - iptables -t nat -N DOCKER_OUTPUT | |
| 22 | - iptables -t nat -N DOCKER_POSTROUTING | |
| 23 | - iptables -t nat -A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT | |
| 24 | - iptables -t nat -A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING | |
| 25 | - iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -j DNAT --to-destination 127.0.0.11:$TCP_PORT | |
| 26 | - iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -j DNAT --to-destination 127.0.0.11:$UDP_PORT | |
| 27 | - iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -j SNAT --to-source :53 | |
| 28 | - iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -j SNAT --to-source :53 | |
| 17 | +# 2. Selectively restore ONLY internal Docker DNS resolution | |
| 18 | +if [ -n "$DOCKER_DNS_RULES" ]; then | |
| 19 | + echo "Restoring Docker DNS rules..." | |
| 20 | + iptables -t nat -N DOCKER_OUTPUT 2>/dev/null || true | |
| 21 | + iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null || true | |
| 22 | + echo "$DOCKER_DNS_RULES" | xargs -L 1 iptables -t nat | |
| 23 | +else | |
| 24 | + echo "No Docker DNS rules to restore" | |
| 29 | 25 | fi |
| 30 | 26 | |
| 31 | 27 | # First allow DNS and localhost before any restrictions |