Sandboxed Bash fails with "bwrap: Can't create file at .git: Is a directory" in normal (non-worktree) git repos

I tried to reproduce this on 2.1.233 on Linux (Ubuntu, bubblewrap 0.9.0): fresh git init repo with a commit, "sandbox": {"enabled": true} in .claude/settings.json, then sandboxed Bash commands (date, git status, git add, file writes). Everything worked, and the sandbox was verifiably active (writes outside the repo were blocked). A git worktree add checkout behaved the same. I also repeated the exact scenario on 2.1.197 (the version you reported) and could not trigger the bwrap: Can't create file at <repo>/.git error there either.

That error indicates the sandbox tried to mount a file over your .git directory, which shouldn't happen for a plain clone with default settings — so something specific to your setup is likely involved. Could you share:

1. The sandbox section of your ~/.claude/settings.json and the repo's .claude/settings.json / .claude/settings.local.json — especially any filesystem.denyWrite / denyRead entries covering the repo or .git
2. Whether .git existed before you launched Claude Code (or was created/re-cloned mid-session)
3. Output of ls -la .git and git rev-parse --git-dir in the repo
4. A debug log from a failing command: start with claude --debug-file /tmp/cc-debug.txt, trigger the failure, and attach the relevant lines
5. Whether it still happens on the latest release (note 2.1.223 fixed a related "sandboxed commands failing to start on Linux" issue when a deny rule covers the working directory)

🤖 Generated with Claude Code

We weren't able to reproduce this. Could you provide steps to trigger the issue — what you ran, what happened, and what you expected? This issue will be closed automatically if there's no activity within 7 days.

No longer reproducible on my setup — this looks fixed and can probably be closed.

Tested in a plain (non-worktree) clone where .git is a directory, which is the
condition described in the report:

• .git is a real directory (drwxrwxr-x 8)
• Sandbox confirmed active: writes outside the allowlist fail with

"Read-only file system", while .git/ remains writable

• Sandboxed date and other commands run normally; no

bwrap: Can't create file at <repo>/.git: Is a directory

Environment:

• claude-code 2.1.234
• bubblewrap 0.9.0
• kernel 7.0.0-28-generic
• kernel.apparmor_restrict_unprivileged_userns=0, so the secondary

bwrap: loopback: Failed RTM_NEWADDR symptom does not apply here either

Caveat: this is a different kernel and a newer claude-code than the original
report (Ubuntu, kernel 6.17.0-29-generic), so I can't rule out that the bug
still exists on the reporter's configuration. Worth a confirmation from someone
on 24.04+ with the apparmor sysctl set to 1 before closing.