[BUG] v2.1.131 native binary hangs on input with seccomp filter in Docker container — ioctl blocked

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

text

Environment

• Claude Code version: v2.1.131 (installed via npm)
• Installation: npm install -g @anthropic-ai/claude-code
• Host: Docker container (Linux)
• OS, kernel, glibc details:

=== OS Release ===
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

=== Kernel ===
3.10.0-1160.119.1.el7.x86_64

=== glibc version ===
ldd (Ubuntu GLIBC 2.35-0ubuntu3.13) 2.35

=== Node version ===
v24.15.0

=== npm claude version ===
/usr/local/lib
└── @anthropic-ai/claude-code@2.1.131

=== Binary ldd (missing libs) ===

text

• Node.js version: v24.15.0 (but this issue is in the native binary, not the Node wrapper)

Problem

After upgrading from v2.1.110 to v2.1.131, running claude in the container starts the TUI (displays the welcome screen) but then hangs for about 60 seconds with all keyboard input ignored, then silently exits. No error message is printed.

• v2.1.110 works perfectly in the identical container.
• v2.1.131 works fine on Windows (native), but fails on Linux in this Docker environment.
• The VS Code Claude extension works normally (it uses its own sandbox).

Diagnostics performed

1. Node.js terminal test passes — raw mode can be set and keyboard input read normally via process.stdin.setRawMode(true). This rules out general TTY or terminfo issues.
2. Non-interactive pipe mode works: echo "hello" | claude --print "Say hi" returns a valid response instantly.
3. strace not permitted inside container, but /proc analysis gives clear evidence.

1. Key finding from /proc while process hangs:

• Seccomp: 2 (SECCOMP_MODE_FILTER) — the native binary enables a seccomp sandbox.
• State: T (stopped) — process eventually receives SIGTTOU (exit code 150 = 128+22).
• /proc/<pid>/syscall repeatedly shows syscall 16 (ioctl) with the same arguments, indicating it is stuck in an ioctl loop trying to configure the terminal (TCGETS/TCSETS).

1. Binary symbols: readelf -s confirms the binary uses tcgetattr and tcsetattr.

1. Environment variable attempts (CLAUDE_CODE_DISABLE_SECCOMP=1, NO_SECCOMP=1, CLAUDE_CODE_NO_SANDBOX=1, TERM=linux, TERM=dumb) did not help.

1. The binary is at /usr/local/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe and is an ELF binary (not a Node.js script). cli-wrapper.cjs spawns it.

Likely cause

The v2.1.131 native binary activates an internal seccomp filter that blocks or mishandles ioctl on this Docker container's PTY, causing terminal initialization to hang. v2.1.110 was pure Node.js and had no such sandbox.

Request

Please investigate seccomp compatibility in the new native binary. If possible, provide a flag to disable the internal seccomp sandbox, or adjust the filter to allow necessary terminal ioctl operations in container environments.

Temporary workaround

Downgrading to v2.1.110 restores full functionality:
npm install -g @anthropic-ai/claude-code@2.1.110

What Should Happen?

In the Linux terminal, you can enter the normal operation of Claude by using the "claude" command, instead of getting stuck and having to exit.

Error Messages/Logs

Steps to Reproduce

linux终端：
claude update
claude

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.131

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Xterm

Additional Information

_No response_