sandbox.enabled: false setting ignored — bwrap still wraps all Bash commands

Description

sandbox.enabled: false in ~/.claude/settings.json is not respected. Claude Code v2.1.79 on Linux still wraps every Bash tool invocation in bwrap (bubblewrap) with --die-with-parent --unshare-pid --unshare-net, making it impossible to run persistent background processes (e.g. next dev, cargo watch) from within a session.

Environment

• Claude Code: 2.1.79
• OS: Arch Linux (kernel 6.18.13-arch1-1)
• bwrap: 0.11.0
• Permission mode: bypassPermissions

Settings

{
  "permissions": {
    "defaultMode": "bypassPermissions"
  },
  "sandbox": {
    "enabled": false
  },
  "skipDangerousModePermissionPrompt": true
}

Observed behavior

Every Bash command is wrapped in bwrap. PID 1 inside the sandbox is:

bwrap --new-session --die-with-parent --unshare-pid --unshare-net \
  --setenv SANDBOX_RUNTIME 1 \
  ...

Consequences:

1. Background processes die — --die-with-parent kills all children when the wrapping shell exits, so next dev &, nohup, setsid, and disown all fail to keep a server running across Bash tool invocations.
2. Network is isolated — --unshare-net creates a separate network namespace. External tools (Playwright MCP, browser) cannot connect to servers started inside the sandbox, and curl from inside the sandbox cannot reach servers started outside.
3. SANDBOX_RUNTIME=1 is set in the environment despite the user setting sandbox.enabled: false.

Expected behavior

With sandbox.enabled: false, Bash commands should run without bwrap wrapping, allowing:

• Background processes to persist across tool invocations
• Network access without namespace isolation
• Dev servers to be started and accessed by other tools (Playwright, curl, browser)

Steps to reproduce

1. Set "sandbox": { "enabled": false } in ~/.claude/settings.json
2. Set "defaultMode": "bypassPermissions" in permissions
3. Start Claude Code v2.1.79 on Linux with bwrap installed
4. Run any Bash command and inspect PID 1: cat /proc/1/cmdline | tr '\0' ' '
5. Observe bwrap is wrapping the command despite sandbox being disabled
6. Try to start a dev server in background and connect to it from a subsequent command — it will fail

Workaround

Start the dev server in a separate terminal outside Claude Code. The only current workaround for the bwrap wrapping itself would be to remove/rename /usr/bin/bwrap, which is not ideal.