[Bug] Linux sandbox fails: apply-seccomp setgroups "Permission denied" on Ubuntu 26.04

Bug Description

Bug report draft: Claude Code Linux sandbox fails with apply-seccomp setgroups error

Environment: Claude Code 2.1.296 (native installer), Ubuntu Server 26.04.1 LTS, kernel 7.0.0-38-generic, bubblewrap 0.11.1 (Ubuntu package), socat installed. Unprivileged user (no sudo).

Settings: sandbox.enabled: true, allowUnsandboxedCommands: false, failIfUnavailable: true, filesystem.denyRead for a few credential paths, network.allowedDomains for GitHub/npm/PyPI.

Reproduction: claude -p "<run touch ./x with Bash>" --allowedTools Bash. Every sandboxed Bash command, including touch ./x inside the working directory, exits 1 before running with:

apply-seccomp: write /proc/self/setgroups (nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN): Permission denied

Tried:

1. The documented /etc/apparmor.d/bwrap profile (flags=(unconfined), userns), with AppArmor reloaded: same error.
2. Additionally kernel.apparmor_restrict_unprivileged_userns=0: same error.

On the same machine, Codex CLI 0.162.1's bubblewrap sandbox works with system /usr/bin/bwrap.

Expected: sandboxed commands run, or the docs name a setting to skip the optional seccomp layer, or a supported AppArmor profile for the helper.

Environment Info

• Platform: linux
• Terminal: ssh-session
• Version: 2.1.294
• Feedback ID: 112b811d-aa9f-4690-9d6c-cdb4f6dad62c