[BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted"

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Sandbox fails immediately on any command with: bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

What Should Happen?

Commands should run in sandbox without network namespace errors.

Error Messages/Logs

bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted

Steps to Reproduce

1. Install bubblewrap and socat: sudo apt install bubblewrap socat
2. Enable sandbox: /sandbox
3. Run any command (e.g., ls)
4. Observe error

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.0.73 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

• Linux kernel: 6.8.0-90-generic
• bubblewrap: 0.9.0
• kernel.unprivileged_userns_clone = 1 (verified enabled)
• No AppArmor restrictions on bwrap (aa-status | grep bwrap returns nothing)
• Issue: bubblewrap cannot configure loopback network in unprivileged user namespace (requires CAP_NET_ADMIN)
• Suggested fix: Use --share-net flag for commands that don't need network isolation
• Terminal/Shell: Other : ddterm 62.0.2 402c0b438 (64)