[BUG] Sandbox startup error on Linux shows unrendered `${j$}` instead of the failing sandbox component

What's Wrong?

When Claude Code v2.1.98+ refuses to start because the sandbox can't initialise on Linux, the error message contains an unrendered JavaScript template literal:

Error: sandbox required but unavailable: ${j$}
sandbox.failIfUnavailable is set — refusing to start without a working sandbox.

The ${j$} is a minified variable name (j$) that should have been interpolated — presumably the failing sandbox component (bwrap, landlock, seccomp, etc.) or its exit detail. Users see literal ${j$} instead of useful context.

Why This Matters

The error blocks startup completely — no project loads, no --help from inside the REPL, nothing. Without the missing variable there's no signal pointing at:

• Which sandbox component failed
• What the underlying syscall / exit code was
• Where to look for the fix

In my case the actual cause was Ubuntu 24.04's kernel.apparmor_restrict_unprivileged_userns=1 default blocking bwrap from creating user namespaces (well-documented in #17727, fix in this comment). I only worked it out by SSH'ing in from another tool and asking it to diagnose. A first-time user without a backup would be stuck.

Suggested Fixes

Two scoped, separable asks:

1. Fix the template literal substitution so ${j$} becomes the actual failing-component name. Whatever's stopping the variable from being interpolated (minifier interaction? closure capture? String.raw somewhere?) is itself the bug — the surrounding error path looks correct.

1. Make the error actionable on Linux. When bwrap exits with Permission denied during uid map setup and /proc/sys/kernel/apparmor_restrict_unprivileged_userns reads 1 (both cheap to detect at startup), include a one-line pointer in the error message — e.g. "On Ubuntu 24.04+, bubblewrap requires an AppArmor profile to create user namespaces — see [docs link]."

Reproduction

1. Fresh Ubuntu 24.04 LTS with the default apparmor_restrict_unprivileged_userns=1
2. apt install bubblewrap (yields 0.9.0)
3. Install Claude Code v2.1.98+ (reproduced on v2.1.120)
4. Run claude from any directory
5. Observe error with unrendered ${j$} and no recovery hint

Environment

• Claude Code: 2.1.120
• OS: Ubuntu 24.04 LTS
• Kernel: 6.8.0-110-generic
• bubblewrap: 0.9.0
• AppArmor LSM: enabled
• kernel.apparmor_restrict_unprivileged_userns: 1 (Ubuntu 24.04 default)
• kernel.unprivileged_userns_clone: 1

Related

• #17727 — broad Linux sandbox issues; AppArmor fix posted as a comment on 2026-03-27 but still buried in a long thread
• #46168 — sandbox initialisation failures on Linux (apply-seccomp helper missing in v2.1.98+)
• #50781 — bwrap sandbox fails with read-only filesystem error