[DOCS] devcontainer feature silently overwrites custom init-firewall.sh

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/devcontainer

Section/Topic

Restrict network egress

Current Documentation

The docs currently say: "The reference container includes an init-firewall.sh script"

What's Wrong or Missing?

The documentation does not explain that /usr/local/bin/init-firewall.sh will be overwritten by a file provided by ghcr.io/anthropics/devcontainer-features/claude-code:1.0

Being new to both Docker and devcontainers, debugging this took quite some time. It's made worse by both the reference container and the devcontainer-feature having a bug in their init-firewall.sh, https://github.com/anthropics/claude-code/issues/55623

Suggested Improvement

Add a warning infobox to the "Restrict network egress" section:

If you are using the ghcr.io/anthropics/devcontainer-features/claude-code devcontainer feature, be aware that it installs its own init-firewall.sh to /usr/local/bin/init-firewall.sh. This runs after the Dockerfile build and will overwrite any file at that path. If you need a custom firewall script, use a different filename (e.g., project-firewall.sh) and update your postStartCommand accordingly.

Impact

High - Prevents users from using a feature

Additional Context

_No response_