The sandbox issues on Linux
Issues the maintainers labelled both platform:linux and area:sandbox.
150 issues · 35 open · 115 resolved (77%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is converging. 57 new reports in the last 90 days vs 86 in the 90 before — -34%. The open backlog peaked at 42 in 2026-04 and sits at 35 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
109 of these reports name the Claude Code build they were running, spanning 73 releases. Heaviest reporters:
- Claude Code v2.1.114
- Claude Code v2.1.232
- Claude Code v2.1.179
- Claude Code v2.1.119
- Claude Code v2.1.112
- Claude Code v2.1.97
- Claude Code v2.1.92
- Claude Code v2.1.236
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 115 closures. Of the 115 closures with a recorded reason, 30% were closed as completed and 80 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
64 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- The only real workaround that I found: 1) Install via npm: npm install -g @anthropic-ai/claude-code@latest 2) Fix executable bit: chmod +x <npm-prefix /lib/node modules/@anthropic-ai/claude-code/vendor/seccomp/x64/apply-…
Found in the thread of #43454 · still open - Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- …n for any agent workflow that stages before committing. The workaround (always stage explicit paths) is only discoverable by hitting the error. None of it is documented: never mentions stub files, protected-path artifact…
Found in the description of #78419 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved - Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- …thread , if the helper's entry point can run early enough. Workarounds, for anyone else hitting this What we shipped: a small wrapper early on that rewrites the prefix to run under first. util-linux is single-threaded,…
Found in the description of #86928 · still open - [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- …o NOT fix it: sandbox.enabled: false FWIW, for me this does work around it. Of course this results in no sandboxing being applied, but it allows me to use Claude CLI for now. If I set that to I immediately get the issue…
Found in the thread of #64799 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- Sandbox sets TMPDIR=/tmp/claude but writable dir is /tmp/claude-$UID
- Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- [BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" on Ubuntu 25.10 / kernel 6.17 (still broken, ref #14719)
- [BUG] Standalone CLI binary missing seccomp binaries — /doctor reports "seccomp not available"
- [BUG] `apply-seccomp` binary loses execute bit after auto-update (Linux)
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- Sandbox sets TMPDIR to non-existent directory, causing child processes to hang
- sandbox.enabled: false setting ignored — bwrap still wraps all Bash commands
- [BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls
- sandbox.filesystem.denyWrite/denyRead silently ignore relative paths; only absolute paths work
- Sandbox crashes when auto-denied file paths traverse symlinks
- [BUG] bwrap fails in a worktree when .claude/skills is a symlink in a repository
- Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- Bash sandbox (bubblewrap) corrupts `!` to `\!` in commands, making the sandbox unusable for agentic workflows
- [BUG] sandbox auto-allow does not work vor env-prefixed commands
- v2.1.98 regression: rw bind mounts inside ~/.claude shadowed by parent ro mount
- [Feature Request] Support GPG commit signing in sandboxed environment
- [BUG] sandbox.enabled: false does not disable bwrap when working directory is ~/.claude/
- [BUG] Ink rendering crash "<Box> can't be nested inside <Text>" when teammate requests sandbox bypass permission
- sandbox filesystem denyRead not enforced for Read tool or Bash commands
- [BUG] sandbox denyRead seems ineffective
- [BUG] ENV_SCRUB=1 sandbox leaves persistent 0-byte placeholder files in cwd AND $HOME (.netrc, .bashrc, .gitconfig) — still in v2.1.211
- [BUG] Sandbox startup error on Linux shows unrendered `${j$}` instead of the failing sandbox component
- [BUG] Sandbox fails inside Docker containers: nested user namespace in apply-seccomp causes EACCES on /proc/self/setgroups
- [BUG] Pipes silently broken in sandbox: shell-quoted "<" in oAD passes literal argument to eval instead of redirect
- [Bug] filesystem.denyRead not merged with Read(...) deny permissions in sandbox
- Sandbox filesystem rules can't scope to git root, breaking worktree workflows
- [BUG] Cowork sandbox: unlink(2) returns EPERM on owned files, breaks .git lock cleanup
- Sandbox bind-mounts /dev/null device nodes in working directory, breaking Python build tools
- [BUG] claude --continue aborts on Linux 2.1.120 with `sandbox required but unavailable: ${j$}` (unfilled template literal)
- sandbox.enabled: false ignored at runtime; allowWrite emits doubled path prefix (2.1.116)
- bwrap launcher uses --bind for optional hardware paths (/opt/cuda*); fails on systems without CUDA installed
- [BUG] Sandbox deny rules with mid-path globs cause E2BIG on Linux — per-file bwrap expansion instead of per-directory overlay
- [BUG] Sandbox bwrap fails when ~/.nix-profile exists as a symlink to a directory
- [BUG] `sandbox.filesystem.denyRead` silently bypassed when target is inside a `denyWrite` directory
- Sandbox mode leaves read-only bind mounts that persist after disable
- [BUG] Specifying `Edit(filepath)` in `permissions.deny` whilst also specifying the filepath in `denyWrite` for `sandbox` causes bwrap failures on all bash tool calls
- excludedCommands in sandbox config does not bypass bwrap filesystem restrictions
- [BUG] sandbox.enableWeakerNestedSandbox silently forced to false when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set (breaks Bash sandbox in cap-dropped nested Docker)
- [BUG] Permission prompts fire inside sandbox-allowed paths, training users to add permissions.allow entries that genuinely bypass the sandbox
- [Bug] Claude Code blocks credential-based API calls due to overly restrictive safety filters, the existence of "Auto Mode " and "Goal" is surrendered
- [BUG] Sandbox allowRead glob patterns silently fail when any directory contains a symlink loop
- [BUG] Sandbox doesn't work when ~/.claude/settings.json is read-only symlink to nix-store
- [BUG] `**/` glob prefix in deny rules causes massive context bloat on Linux/WSL but not macOS
- [DOCS] Sandboxing docs missing Linux subprocess isolation and `CLAUDE_CODE_SCRIPT_CAPS`
- [BUG] Sandbox suggestion from the docs breaks Bash's working dir
- [BUG] aarch64 linux (al2023) bash tool process spawning completely broken
- [BUG] Can't change tabs in /sandbox command
- [BUG] [Linux/Sandbox] bubblewrap creates persistent 0-byte read-only stub files in .claude/ of other projects
- Sandbox: bwrap fails when auto-generated .env deny path resolves through symlink into read-only /nix/store
- Sandbox blocks inbound SSO/OAuth loopback callback from Bash-tool CLI commands (Linux/WSL2)
- Claude Code binary silently disables transparent huge pages (THP)
- [Bug] Experimental CreateTeam: peer agents not inheriting workspace auto-approval for sandbox bash and repo filesystem operations
- [BUG] Bash tool dispatch with sandbox stalls 8-16s between permission decision and shell spawn; UI frozen during stall
- [BUG] model anchors on dangerouslyDisableSandbox: true and keeps applying it to unrelated read-only commands
- sandbox.excludedCommands not honored — adb/fastboot still run inside the sandbox namespace
- [Bug] Sandbox initialization fails on Linux: missing apply-seccomp helper in v2.1.98+
- [BUG] Title: Bash tool: third-party CLI binaries silently fail (exit 1, no output) even with dangerouslyDisableSandbox: true
- Sandbox allowWrite treats absolute paths as relative to ~/.claude/
- excludedCommands does not bypass network sandbox for SSH/git operations
- Per-tool-call helper process (claude.exe) leaks to 11.6GB anon RSS and is OOM-killed during a slow sandboxed Bash command
- Sandboxed Bash fails with "bwrap: Can't create file at .git: Is a directory" in normal (non-worktree) git repos
- [BUG] Sandbox recursively enumerates workspace into nested node_modules → unbounded memory → OOM (still repros on 2.1.195; cf #27863)
- [BUG] sandbox.filesystem の deny bind-mount が Bash コマンド終了後も残存・累積する（解除に sudo umount が必要）
- sandbox.enabled: true triggers a synchronous full-tree directory walk on startup → multi-minute hang in large workspaces
- Sandboxed Bash commands get a spurious backslash before `!` (shell-quote re-escapes the eval wrapper)
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- Slash-command skills with !`...` frontmatter expansions fail to load when sandbox cannot create network namespace
- Sandbox bind-mounts of nonexistent deny-listed paths appear as untracked files in git status
- [Bug] Sandbox unavailable error when sandbox.failIfUnavailable is enabled
- Sandbox cgroup silently disables transparent huge pages (THP)
- Sandbox/bwrap fails in git worktrees: Can't create file at .claude/commands
- bwrap: Can't mount devpts on first sandbox invocation inside rootless podman/Docker container
- [Bug] socat presence causes bwrap sandbox to fail silently or error on Ubuntu
- [BUG] Sandbox fails when denyRead paths don't exist: bwrap can't mount tmpfs on non-existent directory
- [BUG] Sandbox silently prevents cmake/ninja builds without error on Linux
- BPF sandbox does not propagate user command rejections as session-scoped blocklist rules
- [BUG] sandbox.enabled: true silently ignored when socat is not installed (security risk)
- [BUG] Sandbox + `httpProxyPort` enabled, but Claude cannot access HTTP endpoint (`Connection refused`)
- Config save creates lock/temp files in ~/ which breaks sandboxed environments
- [BUG] `sandbox.network.strictAllowlist` has no effect — Bash tool dispatcher never invokes bwrap, on any tested version
- Bash sandbox intermittently fails with apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] sandbox.filesystem.denyWithinAllow not enforced for Edit/Write tools
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- [BUG] bgIsolation containment check isn't realpath-canonicalized; symlinked cwd bypasses it
- Claude Code ran rm -rf against $HOME due to env var not persisting between Bash tool calls, deleting Downloads/Documents/Pictures/.config
- [BUG] claude cli insists on writing /tmp/claude-1000
- [BUG] There is no indication to the user when Claude sets `dangerouslyDisableSandbox: true`
- Regression: sandbox no longer blocks commands not in excludedCommands (default-deny model broken)
- [BUG] No sandbox warning in terminal
- Feature request: sandbox GPU/CUDA access via --dev-bind for /dev/nvidia* device nodes
- [BUG] Running claude in a folder with a .git folder without rwx permissions for the current user prevents running bash commands
- [BUG] Sandboxed warning only appears if project on .claude/projects/* doesnt exists