[BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls

Title: [BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls

---

This is a showstopper regression that makes Claude Code completely unusable.

Every single Bash tool call fails. Not some. Not edge cases. ALL of them. Including echo "test". Including dangerouslyDisableSandbox: true. The sandbox cannot even initialize itself.

Error

bwrap: Can't create file at /home/user/.claude/.zshrc: Read-only file system

What's happening

bwrap tries to create .zshrc inside the working directory (~/.claude/) during sandbox initialization. But Claude Code's own sandbox write restrictions mark .claude/ paths as read-only (via denyWithinAllow). The sandbox's setup violates the sandbox's own rules.

The result is a perfect deadlock:

1. User runs any Bash command
2. Claude Code invokes bwrap to sandbox it
3. bwrap tries to write .zshrc into the working directory
4. The sandbox filesystem policy blocks the write
5. bwrap dies before bash ever starts
6. dangerouslyDisableSandbox: true does NOT help — bwrap runs before the flag takes effect

Zero Bash commands can execute. The tool is completely non-functional.

Environment

• OS: Linux 6.17.0-20-generic (Ubuntu)
• Shell: bash (with zsh installed)
• Working directory: ~/.claude/ (a git repo — this is the user's config/working directory)
• bubblewrap: system package
• Claude Code: latest (auto-updated overnight, breaking a working downgraded version)

The auto-update problem compounds this

I downgraded to a working version yesterday. Overnight, Claude Code auto-updated itself back to the broken version. There is no reliable way to pin a working version. CLAUDE_CODE_DISABLE_AUTO_UPDATE=1 is not well-documented and the update behavior is aggressive.

Users should not have to fight their own tooling to maintain a working state.

Related issues

• #40133 — bwrap fails on symlinked .claude/skills directory (same root cause family)
• #41863 — bwrap fails on Ubuntu 24.04 merged-/usr layout
• #18631 — bwrap + symlink regression from 2.1.2+
• #35986 — sandbox.enabled: false setting ignored, bwrap still wraps commands

These have been open for weeks to months. The sandbox on Linux is fundamentally broken across multiple configurations and nobody is fixing it.

Expected behavior

Bash tool calls should execute. At minimum, dangerouslyDisableSandbox: true should actually disable the sandbox.

Actual behavior

Nothing works. Claude Code is a $200/month subscription tool that cannot run echo "test".

Workaround

The only known workaround is manually editing settings to disable the sandbox entirely — which defeats the purpose of having one.