Devcontainer: init-firewall.sh aborts on boot when two allowlisted domains resolve to the same IP (ipset duplicate + set -e)

Summary

The official devcontainer fails on first boot when two domains in init-firewall.sh's allowlist resolve to the same IP address. The script runs under set -euo pipefail, and the per-domain resolution loop adds each resolved IP with ipset add allowed-domains "$ip". On a duplicate, ipset errors:

ipset v7.17: Element cannot be added to the set: it's already added

set -e then aborts the script, postStartCommand exits 1, and the container comes up without completing firewall initialization:

postStartCommand from devcontainer.json failed with exit code 1.
Error: Command failed: /bin/sh -c sudo /usr/local/bin/init-firewall.sh

Reproduction

Deterministic whenever two allowlisted domains share an IP, which is common with CDN-fronted hosts. Observed live on 2026-09-01 (stock .devcontainer from main, Docker Desktop on Windows 11 + @devcontainers/cli): marketplace.visualstudio.com and vscode.blob.core.windows.net both resolved to 150.171.74.16, so the second add failed and the boot aborted, every run.

Fix (one line)

Use ipset's idempotent add in the per-domain loop:

-        ipset add allowed-domains "$ip"
+        ipset add -exist allowed-domains "$ip"

The aggregate CIDR loop above it could take the same flag if overlapping ranges ever appear in GitHub's meta ranges; the minimal fix only touches the per-domain loop.

Since this repo doesn't accept external pull requests, the change is ready to cherry-pick from pedro-silva-hub/claude-code@001c048d6eba062d8bbf7f7e2d538f00e833e28b (branch fix/devcontainer-ipset-exist).

Verification after the fix

Container boots clean and default-deny still holds: non-allowlisted domain blocked, registry.npmjs.org reachable, sudo -n iptables denied for the node user, workspace-only writes enforced.

🤖 Generated with Claude Code

https://claude.ai/code/session_013MrVJ8vhVRNyP3JjhM3VRG