Sandbox fails with "bwrap: execvp /bin/bash: No such file or directory" on Ubuntu 24.04

Bug Description

All Bash tool calls fail when sandbox is enabled, with the error:

bwrap: execvp /bin/bash: No such file or directory

Environment

• Claude Code: 2.1.89
• OS: Ubuntu 24.04.4 LTS (Noble Numbat)
• Kernel: 6.8.0-106-generic x86_64
• bubblewrap: 0.9.0
• bash: /bin/bash exists, ELF 64-bit LSB pie executable

Sandbox config (settings.json)

"sandbox": {
  "enabled": true,
  "filesystem": {
    "denyRead": ["/"],
    "allowRead": [".", "~/.claude", "$TMPDIR", "/tmp/build", "~/go/pkg/mod", "/usr", "/lib", "/lib64", "/etc", "/bin", "/sbin", "/proc", "/dev"]
  }
}

Reproduction

1. Enable sandbox with the config above on Ubuntu 24.04 with bubblewrap 0.9.0
2. Any Bash tool call fails with bwrap: execvp /bin/bash: No such file or directory

Observations

• /bin/bash exists and is a valid binary (file /bin/bash → ELF 64-bit LSB pie executable)
• Running bwrap manually with --ro-bind /bin /bin works fine: bwrap --ro-bind /bin /bin --ro-bind /usr /usr --ro-bind /lib /lib --ro-bind /lib64 /lib64 --proc /proc --dev /dev /bin/bash -c "echo works" → success
• Disabling sandbox ("enabled": false) or using dangerouslyDisableSandbox: true works around the issue

Workaround

Disable sandbox in settings or approve dangerouslyDisableSandbox per command.