[DOCS] [sandbox] sandbox.bwrapPath and sandbox.socatPath managed settings undocumented for Linux/WSL

Documentation Type

Missing documentation (feature not documented)

Documentation Location

https://code.claude.com/docs/en/settings

Section/Topic

sandbox configuration section under "Configure advanced sandboxing behavior" — the table of sandbox.* settings (lines 296–320)

Current Documentation

The Settings reference documents sandbox.enabled, sandbox.failIfUnavailable, sandbox.autoAllowBashIfSandboxed, sandbox.excludedCommands, sandbox.allowUnsandboxedCommands, sandbox.filesystem.*, sandbox.network.*, enableWeakerNestedSandbox, and enableWeakerNetworkIsolation — but does not mention bwrapPath or socatPath.

The Sandboxing page shows how to install bubblewrap and socat:

On Linux and WSL2, install the required packages first: ``bash theme={null} sudo apt-get install bubblewrap socat ``

And:

If required dependencies are missing (such as bubblewrap or socat on Linux), the menu displays installation instructions for your platform.

Both docs assume system-package installation with the binaries on $PATH. Neither document supports custom binary locations.

What's Wrong or Missing?

As of v2.1.133, Claude Code adds sandbox.bwrapPath and sandbox.socatPath as managed settings (Linux/WSL only) that let users specify custom paths to the bubblewrap and socat binaries instead of relying on $PATH resolution.

These settings are entirely absent from the Settings reference documentation. Users of managed settings who need to use custom-built or non-standard binary locations for sandbox isolation have no documented way to configure this.

Suggested Improvement

Add two rows to the sandbox settings table in the Settings reference:

| Keys | Description | Example |
| :--------------- | :---------------------------------------------------------------------------------------------------- | :---------------- |
| bwrapPath | (Linux/WSL only) Path to the bubblewrap binary. Use this when the binary is not on $PATH or a custom build is needed. Default: bwrap resolved from $PATH | "/usr/local/bin/bwrap" |
| socatPath | (Linux/WSL only) Path to the socat binary. Use this when the binary is not on $PATH or a custom build is needed. Default: socat resolved from $PATH | "/usr/bin/socat" |

Also consider adding a brief cross-reference in the Sandboxing prerequisites section (line 78 onward) noting that custom binary paths can be configured via these settings.

Impact

High - Prevents users from using a feature

Additional Context

Changelog entry (v2.1.133):

Added sandbox.bwrapPath and sandbox.socatPath managed settings (Linux/WSL) to specify custom bubblewrap and socat binary locations

Affected Pages:

| Page | Context |
|------|---------|
| https://code.claude.com/docs/en/settings | Primary docs — sandbox.* settings table missing both bwrapPath and socatPath |
| https://code.claude.com/docs/en/sandboxing | Prerequisite installation instructions (lines 78–92) assume PATH binaries only |

Total scope: 2 pages affected