Bash tool fails on every command: bwrap can't mkdir /run/containerd/containerd.sock (Permission denied)

Bug report

Claude Code version: 2.1.266 (confirmed up to date via claude update)

OS: Debian GNU/Linux 13 (trixie), kernel 6.1.0-18-amd64, x86_64

Description

Every Bash tool invocation fails, regardless of whether the project/user-level sandbox is enabled or disabled. The underlying bwrap (bubblewrap) call attempts to create /run/containerd/containerd.sock and fails with a permission error, because /run/containerd is owned by root:root with mode drwx--x--x (no write access for non-root users). This happens even with dangerouslyDisableSandbox: true on the tool call, and even with "sandbox": {"enabled": false} set in .claude/settings.local.json.

Steps to reproduce

1. On a Debian (or any Linux) host with containerd installed and running as a systemd service (socket at /run/containerd/containerd.sock, owned root:root, mode drwx--x--x on the parent dir).
2. Run any Bash tool command in Claude Code, e.g. echo test.
3. Command fails immediately with no stdout, exit code 1.

Expected behavior

The Bash tool executes the command normally (either sandboxed per the configured policy, or unsandboxed if sandbox.enabled is false / dangerouslyDisableSandbox: true is passed).

Actual behavior

Every command fails with:

bwrap: Can't mkdir parents for /run/containerd/containerd.sock: Permission denied

This reproduces even when:

• dangerouslyDisableSandbox: true is passed on the tool call.
• .claude/settings.local.json in the project has:

``json
{ "sandbox": { "enabled": false } }
``

• Global ~/.claude/settings.json has no sandbox-related configuration at all.

/sandbox slash command reports "○ Sandbox disabled", but the underlying Bash execution still shells out through bwrap and still attempts the same mount/mkdir, so the failure persists.

Environment details

• uname -a: Linux debian 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux
• /etc/os-release: Debian GNU/Linux 13 (trixie)
• User: uid=1000(aldosierra), groups include docker (124) but not root.
• containerd is installed and running as a systemd service, actively used for Docker on this host (unrelated to Claude Code).
• /run/containerd permissions: drwx--x--x root root
• /run/containerd/containerd.sock permissions: srw-rw---- root root

Hypothesis

The Bash tool's sandbox launcher appears to unconditionally attempt to bind-mount or create /run/containerd/containerd.sock inside the bwrap sandbox namespace (likely so sandboxed processes can reach a container runtime), without first checking write permissions on the socket's parent directory, and without honoring the sandbox.enabled: false setting or dangerouslyDisableSandbox: true to skip this step entirely.

Impact

Every Bash tool call fails on this machine — Claude Code is unable to run any shell command at all.