[BUG] init-firewall.sh fails on duplicate IPs from DNS — container fails to start

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug: init-firewall.sh fails when a domain resolves to duplicate IPs
Environment:
macOS, Docker Desktop (latest as of March 2026)
Fresh clone of the claude-code devcontainer template

What Should Happen?

Expected: Container starts successfully with firewall rules applied
Actual: Container fails to start with exit code 1. The script calls ipset add for each resolved IP, but domains like marketplace.visualstudio.com return duplicate IPs across multiple DNS records, causing ipset to error with:
ipset v7.17: Element cannot be added to the set: it's already added
Fix (?): Replace ipset add with ipset add --exist in init-firewall.sh to silently skip duplicates

Error Messages/Logs

ipset v7.17: Element cannot be added to the set: it's already added

Steps to Reproduce

Steps to reproduce:

Clone the claude-code devcontainer template
Open in VS Code and rebuild the container

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

devcontainer crashes before claude --version can be used

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_