[DOCS] devcontainer feature silently overwrites custom init-firewall.sh

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://docs.anthropic.com/en/docs/claude-code/devcontainer

Section/Topic

The devcontainer setup consists of three primary components

Current Documentation

The Doc currently says:

The devcontainer setup consists of three primary components: devcontainer.json: Controls container settings, extensions, and volume mounts · Dockerfile: Defines the container image and installed tools · init-firewall.sh: Establishes network security rules

and

The devcontainer configuration is designed to be adaptable to your needs

But:

No mention anywhere that the ghcr.io/anthropics/devcontainer-features/claude-code:1.0 feature also installs its own init-firewall.sh to /usr/local/bin/init-firewall.sh, which will silently overwrite any user-customized version at that path.

What's Wrong or Missing?

The documentation encourages users to customize init-firewall.sh as part of their devcontainer setup, but does not mention that the ghcr.io/anthropics/devcontainer-features/claude-code:1.0 feature installs its own init-firewall.sh to /usr/local/bin/init-firewall.sh. Because devcontainer features run after the Dockerfile build, the feature's version silently overwrites any user-customized version at that path. There is no warning in either the devcontainer guide or the feature's README.

Suggested Improvement

Add a warning to the devcontainer guide under the three primary components section:

Note: If you are using the ghcr.io/anthropics/devcontainer-features/claude-code devcontainer feature, be aware that it installs its own init-firewall.sh to /usr/local/bin/init-firewall.sh. This runs after the Dockerfile build and will overwrite any file at that path. If you need a custom firewall script, use a different filename (e.g., project-firewall.sh) and update your postStartCommand accordingly.

Impact

High - Prevents users from using a feature

Additional Context

_No response_