Bash execution issues on Linux — page 2
Issues the maintainers labelled both platform:linux and area:bash.
197 issues · 43 open · 154 resolved (78%) · first seen Jan 3, 2026
Is this getting better or worse?
This class of problem is converging. 70 new reports in the last 90 days vs 116 in the 90 before — -40%. The open backlog peaked at 43 in 2026-08 and sits at 43 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
151 of these reports name the Claude Code build they were running, spanning 86 releases. Heaviest reporters:
- Claude Code v2.1.233
- Claude Code v2.1.205
- Claude Code v2.1.150
- Claude Code v2.1.158
- Claude Code v2.1.156
- Claude Code v2.1.112
- Claude Code v2.1.68
- Claude Code v2.1.74
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 154 closures. Of the 154 closures with a recorded reason, 27% were closed as completed and 112 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
76 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Bash comments break permissions
- Workaround: a PreToolUse hook can strip the comment lines before permission matching sees them. The hook reads the command, removes leading lines, and returns the clean command via . Your allowlist then matches correctly…
Found in the thread of #29582 · resolved - Background process termination crashes Claude Code in Docker containers
- …al to kill the process group (e.g., ), it kills itself too. Workaround Manually using to isolate background processes works: However, this loses Claude's background process monitoring and notification features. Suggested…
Found in the description of #16135 · still open - Bash(command:*) allow rules do not prevent permission prompts for file-modifying commands
- …in the desktop app ( , then ), and there's no config or UI workaround. Considering reopening this or filing a new issue — happy to do whichever the maintainers prefer.
Found in the thread of #20449 · resolved - [Bug] Agent spams no-op echo probe commands to flush shell output
- …h a real completion signal — never a burst of no-op echoes. Workaround in use: Added an explicit "never fire no-op probe commands" rule to global CLAUDE.md, but the model should not need this instruction — the default be…
Found in the description of #63887 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–197
Ranked by community engagement (reactions weighted over comments).
- [Bug] socat presence causes bwrap sandbox to fail silently or error on Ubuntu
- All Bash tool calls execute asynchronously with no opt-out (v2.1.x)
- [Bug] Build output grepping loses full logs, causing redundant rebuilds on failures
- [BUG] Bash tool hangs ~3 minutes on `docker compose up/down` on Linux
- [BUG] Bash commands fail with exit code 1 and no output (empty rg block in shell snapshot)
- [BUG] Shell initialization fails (exit 127) when .bashrc contains extglob pattern inside command substitution in function definition
- [BUG] sed truncates files
- [Bug] Hard crash with unresponsive input handling
- [BUG] Agent cleanup can non-deterministically kill its own tmux session, losing all work
- [BUG] Bash tool timeout error message is printed twice
- Session spontaneously re-executed hours-old background Bash commands (raw '&') — original order, ~2.3min apart, truncating their logs
- Bundled ugrep shadowing `grep` can exhaust system memory — froze a 16 GB machine twice
- [BUG] Embedded ugrep hangs indefinitely (pegged core) on unanchored bounded-repetition pattern — the same binary's embedded ripgrep finishes in 53 ms
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- Injected grep wrapper (bundled ugrep) consumes 20+ GB RAM on bounded-repeat regex, hard-freezes machine
- Bug: la terminal (ghostty) se cierra por completo al aprobarse un comando Bash con comillas muy anidadas (manual o automáticamente)
- Session-env snapshot file breaks when sourced: unquoted LS_COLORS/SSH_CONNECTION/LESSCLOSE spam 'command not found' on every Bash call
- grep shim (embedded ugrep 7.5.0) allocates unbounded memory on double-bounded-repeat BRE patterns — can OOM-kill the host
- Headless -p session leaks to 10-15GB RSS while idle on long-running background Bash tasks (v2.1.205, Linux)
- Claude Code ran rm -rf against $HOME due to env var not persisting between Bash tool calls, deleting Downloads/Documents/Pictures/.config
- [BUG] There is no indication to the user when Claude sets `dangerouslyDisableSandbox: true`
- [BUG] pytest loop led to OOM
- Main-loop shell cwd silently relocates into a background `isolation: worktree` agent's worktree — git status shows clean, uncommitted changes appear "lost"
- [BUG] Running claude in a folder with a .git folder without rwx permissions for the current user prevents running bash commands
- [BUG] Background-shell counter under-counts SSH-wrapped Bash invocations (v2.1.144)
- Bash tool summary line undercounts find paths and -o patterns
- Bash tool omits `< /dev/null` when user command has any `<`/`<<` redirect, leaking parent stdin to children
- [BUG] Shell tool is returning no output in arch
- [Bug] Spurious permission denial injected into Bash tool error output
- [BUG] Bash tool starts in $HOME instead of session/project cwd under Termux proot, while Claude Code reports cwd was reset
- [BUG] claude code can't access external projects if running via sandboxed environment
- [BUG] Bash tool completely unusable on AlmaLinux 9 — shell snapshot creation fails with "Unable to read input file: Is a directory", exit 127 on every command
- [BUG] PR_SET_THP_DISABLE=1 is inherited into spawned children, breaking applications that rely on THP (devdax SIGBUS)
- [BUG] Claude Code violated .gitignore/.claudeignore policy by reading .env file using Bash cat command in auto-approve mode
- [BUG] Deduplication for Concurrent Background Bash Tasks since 2.1.112 to 2.1.114
- "Unhandled node type: string" prompt interrupts workflow
- [BUG] "unhandled node type $"
- [BUG] Bash tool with `git push` hangs indefinitely in remote control mode — command never reaches the shell
- [BUG] One-line fix unlocks PowerShell on macOS and Linux: cross-platform support was always there, just never turned on
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- [Bug] Bash tool subprocess execution failure on HPC clusters with cgroups/container restrictions
- [BUG] shell snapshot de 318KB auto-generado consume tokens masivamente
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- Background tasks break serial port (device file) read operations
- [BUG] tmpfs user quota causes claude code bash tool to fail
- [Bug] Remote control interferes with bash execution and causes conversation loss
- [Feature Request] Respect user's default shell preference instead of forcing bash
- Bash tool: rejected/cancelled commands still execute (process already started)
- [BUG] Bash tool duplicates stdout in model context when command exits non-zero
- [BUG] Bash tool discards working directory change when command exits with non-zero code
- Nested claude CLI deletes parent session's Bash tool output capture file in /tmp/claude-*
- Bash tool: ZodError in permission system blocks git commands
- [BUG] Bash tool escapes ! inside single-quoted strings, breaking jq != and other commands
- [BUG] Bash tool refused in nested user namespace since 2.1.220: apply-seccomp: write /proc/self/uid_map: Operation not permitted
- Sandboxed Bash wedges permanently when the working directory is on a read-only filesystem (no cwd recovery)
- Bundled search helper allocates without bound on a BRE pattern with a literal | and -o (v2.1.233)
- [BUG] bash-input prefill/tab-completion suggests relative-path script without required ./ prefix
- [BUG] Bash tool timeout backgrounds a command instead of cancelling it — contributed to multi-hour VM disk-saturation incidents under concurrent subagent load
- Background Bash runner process (re-exec'd versioned binary) leaks memory after command completes — 100% CPU, OOM-killed at 10.8GB (v2.1.226 & v2.1.233, Linux)
- [Bug] grep shell shim silently skips binary and ignored files, masking search failures from agents
- Bash tool never surfaces stdout; ordinary commands (echo, printf, date, bare pwd) fail with bare Exit code 1
- Bash tool: grep→ugrep shim exits 2 when one operand is missing even though another matched (GNU grep/POSIX -q exits 0)
- [Bug] Bash-tool grep wrapper still silently returns nothing on text files with a stray NUL byte (2.1.220) — #56644 was auto-closed as stale, not fixed
- Bundled ugrep (Bash `grep` shim) balloons to 14–16.6 GB RSS on bounded-repeat -o patterns that GNU grep handles in 3 MB — repeated OOM kills on a production box
- [Bug] Claude accidentally executes rm -rf on a backup directory in auto mode, acknowledging the mistake directly afterwards
- [BUG] Bash tool normalizeToolInput silently corrupts commands: unanchored replace strips `cd <cwd> && ` even inside quoted strings
- [BUG] Bundled grep/find/rg shims fail with `-G: error while loading shared libraries` when CLAUDE_CODE_EXECPATH is the dynamic loader (native binary launched via ld.so; NixOS)
- Bash tool stdout duplicated N times in tool results (N grows per call); command runs once — capture/render bug, not the shell
- [Bug] Command execution fails when using `!` prefix for external commands
- [BUG] Agent ran an unsafe large recursive write to an ntfs3-mounted volume, triggering NTFS corruption and leaving the disk unmountable
- grep -Z/--null is silently ignored by the bundled grep, breaking "grep -Z | xargs -0" pipelines
- Long-lived daemon caches environment (SHELL) with no drift detection or restart; fish-login users silently get the wrong Bash-tool shell; CLAUDE_CODE_SHELL is undocumented
- Background Bash task: grep→ugrep shim fell back to full multithreaded filesystem scan instead of reading piped stdin, making machine unresponsive
- [Feature Request] Add process timeout and termination for stuck commands
- [Feature Request] Support sudo command execution for system-level operations
- [BUG] Claude CLI will not use "cd", rendering it unable to run commands in a container
- Benign `node -e` regex script false-flagged as "Fork bomb detected"
- Feature request: Bash tool should respect user's configured shell
- Malicious shell command injected into assistant-generated tool_use (command field corrupted with forged result-wrapper tags)
- [BUG] Remote Control session: background Bash tasks killed ~5-7 min after launch while CLI host in tmux stays alive
- Worktree isolation verifies complexity, not targets: a simple Bash command writing an absolute path outside the worktree passes unchecked
- Worktree-isolation guard: string-executor check matches every argument position, case-insensitively
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- [BUG] `Messages sent during a Bash tool call are silently destroyed when the call returns is_error: true`
- Auto-mode classifier false-positives on codex exec and cross-tool state files
- [BUG] On a genuinely full disk, the Bash ENOSPC notice names the session tmpdir instead of the filesystem, and no command can then run to diagnose it
- [BUG] Bash tool dispatch blocks the event loop ~80s in a CPU spin
- Bash-tool grep shadow (2.1.245): present string returns exit 1 — measured repro, embedded ugrep 7.8.4, session-scoped workaround
- [BUG] Completion notifications unreliable for foreground commands auto-backgrounded at the 10-minute cap (inside subagents)
- [BUG] run_in_background tasks intermittently killed ~17-20s after start, seconds after the arming turn ends (terminal CLI, Linux — not idle-timeout timing)
- [BUG] Bash sandbox fails to initialize on Ubuntu 24.04+ - conflict with the distro's default bwrap-userns-restrict AppArmor profile (not a Claude Code regression)
- Bash tool shell runs with `expand_aliases` enabled — shell aliases can silently rewrite commands after PreToolUse hook approval
- [Bug] Auto-mode classifier judges command form, not effect: dry-runs blocked while allowlisted equivalents with larger blast radius pass; denials stack into the 5-consecutive lockout
- [Bug] Claude Code prompts for sudo commands without password input support in terminal
- [Bug] Claude Code re-activates virtual environment on every bash prompt
- [Bug] Unnecessary directory changes trigger security analyzer false positives