[BUG] Cowork sandbox unbootable, needs backend reprovision (known bug)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

ESCALATION — Cowork sandbox unbootable, needs backend reprovision (known bug)
Support conversation / ticket ID: 215474906731697
Problem: My Claude desktop Cowork sandbox will not boot. Every shell/bash call fails during user provisioning, so I cannot run anything in Cowork mode and all my scheduled tasks are dead.
Error (identical on every call, on resume and create):
RPC error: ensure user: useradd failed: exit status 16:
useradd: Can't get unique subordinate UID range
useradd: can't create subordinate user IDs
Root cause — a KNOWN, already-tracked bug (do not re-triage):
This is the subuid-pool-exhaustion variant of the Cowork per-session sandbox leak documented in GitHub anthropics/claude-code #59856 (closed as duplicate; related #24207, #43645). Per-session sandbox users/directories in /sessions/ are never garbage-collected, so the host eventually cannot allocate a unique subordinate UID range for a new session user. My account runs dozens of daily scheduled tasks, which exhausts the pool quickly.
Why this needs infra, not me: Per #59856 there is no user-side recovery — the sandbox user is unprivileged, sudo is blocked, the leftover state is owned by nobody:nogroup, and relaunching the app does not reprovision storage. I have already tried, all with no effect:

quit/reopen app · pkill -f Claude · full macOS reboot · log out/in · updated Claude to the newest version (twice) · brand-new chat → same error every time (reproduces on fresh sessions → server-side, not workspace-specific).

What I'm asking infra to do:

Reprovision / recycle the backend sandbox for my account's Cowork workspace and reset its subuid/subgid pool.
Garbage-collect the stale /sessions/<name>/ users/directories so it doesn't refill.

Please route directly to the infrastructure/Cowork team — this is a confirmed known defect, not a config issue on my side. Environment: macOS · Claude desktop (latest) · model claude-opus-4-8 · first observed 2026-06-29.

What Should Happen?

What I'm asking infra to do:

Reprovision / recycle the backend sandbox for my account's Cowork workspace and reset its subuid/subgid pool.
Garbage-collect the stale /sessions/<name>/ users/directories so it doesn't refill.

Please route directly to the infrastructure/Cowork team — this is a confirmed known defect, not a config issue on my side. Environment: macOS · Claude desktop (latest) · model claude-opus-4-8 · first observed 2026-06-29.

Error Messages/Logs

Every shell/bash call in Cowork mode fails during user provisioning,
identically on both resume and create:

bash failed on resume, create, and re-resume.
resume: RPC error: ensure user: useradd failed: exit status 16:
useradd: Can't get unique subordinate UID range
useradd: can't create subordinate user IDs
; create: RPC error: ensure user: useradd failed: exit status 16:
useradd: Can't get unique subordinate UID range
useradd: can't create subordinate user IDs

Interpretation: the sandbox host can no longer allocate a unique
subordinate UID range (/etc/subuid, /etc/subgid) for a new session
user, because leftover per-session users from prior runs are never
released. This is the subuid-pool-exhaustion form of the leak in
anthropics/claude-code #59856 (Closed as duplicate; related #43645, #24207).

Steps to Reproduce

Slow accumulation, not a single action:

1. Use Cowork mode (macOS Claude desktop app) over several weeks with

many recurring scheduled tasks (my account runs dozens of daily runs).

1. Each session/heartbeat provisions a new sandbox user + /sessions/<name>/

directory and consumes a subordinate UID range; these are never
garbage-collected (see #43645 — scheduled-task heartbeat spawns hundreds
of junk sessions).

1. Over time the host's subuid/subgid pool is exhausted.
2. The next sandbox boot fails in useradd with

"Can't get unique subordinate UID range" / "can't create subordinate
user IDs", and "bash failed on resume, create, and re-resume".

1. From this point every session fails — interactive chats AND all

scheduled tasks — with the same error.

Recovery attempts that do NOT work (all tried):
quit/reopen app · pkill -f Claude · full macOS reboot · log out/in ·
update Claude to latest (twice) · brand-new chat.
Reproduces on fresh sessions → server-side, not workspace-specific.
No user-side reset exists (unprivileged sandbox user, sudo blocked).

Claude Model

Other

Is this a regression?

Yes, this worked in a previous version

Last Working Version

N/A — not a version regression. This is a gradual-accumulation bug: the sandbox worked until its subuid/subgid pool filled from un-released per-session users. It is independent of the app version and persists on the latest build (confirmed after updating twice). No specific "last working version" applies.

Claude Code Version

N/A — this is a Claude desktop app / Cowork (local-agent-mode) bug, not the Claude Code CLI. Desktop app version: see Help > About (last observed: 1.15962.1, Electron 42.4.0; bundled claude-code 2.1.187). Please confirm the current version from the About menu after your recent update. Model: claude-opus-4-8. OS: macOS.

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_