surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Merge pull request #4644 from shota-0129/shota-0129/feat-docker-dns-protectionBrowse files

feat: Add Docker DNS protection to firewall script

ant-kurt authored on Jul 30, 2025 · GitHub committed on Jul 30, 2025 parents b365888 + dde41f6 · commit d720bf7abab3

1 changed file+13 -0compared with b365888

M.devcontainer/init-firewall.sh

M.devcontainer/init-firewall.sh+13 -0

		@@ -2,6 +2,9 @@
2	2	set -euo pipefail # Exit on error, undefined vars, and pipeline failures
3	3	IFS=$'\n\t' # Stricter word splitting
4	4
	5	+# 1. Extract Docker DNS info BEFORE any flushing
	6	+DOCKER_DNS_RULES=$(iptables-save -t nat \| grep "127\.0\.0\.11" \|\| true)
	7	+
5	8	# Flush existing rules and delete existing ipsets
6	9	iptables -F
7	10	iptables -X
		@@ -11,6 +14,16 @@
11	14	iptables -t mangle -X
12	15	ipset destroy allowed-domains 2>/dev/null \|\| true
13	16
	17	+# 2. Selectively restore ONLY internal Docker DNS resolution
	18	+if [ -n "$DOCKER_DNS_RULES" ]; then
	19	+ echo "Restoring Docker DNS rules..."
	20	+ iptables -t nat -N DOCKER_OUTPUT 2>/dev/null \|\| true
	21	+ iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null \|\| true
	22	+ echo "$DOCKER_DNS_RULES" \| xargs -L 1 iptables -t nat
	23	+else
	24	+ echo "No Docker DNS rules to restore"
	25	+fi
	26	+
14	27	# First allow DNS and localhost before any restrictions
15	28	# Allow outbound DNS
16	29	iptables -A OUTPUT -p udp --dport 53 -j ACCEPT