bwrap: Can't mount devpts on first sandbox invocation inside rootless podman/Docker container

Environment

• Claude Code version: 2.1.112
• Container: rootless podman with --userns=keep-id, base image golang:1.25-bookworm
• Host kernel: Linux 6.19.11-200.fc43.x86_64
• enableWeakerNestedSandbox: true set — does not fix the issue

Behavior

Every first Bash tool invocation in a session fails with:

bwrap: Can't mount devpts on /newroot/dev/pts: Permission denied

The retry immediately succeeds and runs fully sandboxed. All subsequent calls in the session work fine.

Root cause

In linux-sandbox-utils.js, --dev /dev is passed unconditionally to bwrap:

// Always bind /dev
bwrapArgs.push('--dev', '/dev');

The --dev flag causes bwrap to create a new virtual /dev including mounting a fresh devpts filesystem on /dev/pts. This requires privileges unavailable in a rootless container user namespace, even with enableWeakerNestedSandbox: true.

Workaround

The failed first attempt exits before executing the command (safe — no network traffic leaks). The retry succeeds, presumably because the first attempt leaves kernel state that the second attempt benefits from. Proxy enforcement via --unshare-net is maintained on all successful executions.

Suggested fix

When enableWeakerNestedSandbox is true, use --dev-bind /dev /dev instead of --dev /dev to bind-mount the host's existing /dev (which already has devpts mounted) rather than creating a fresh virtual one. This avoids the need to mount a new devpts filesystem entirely.