The sandbox issues on Linux
Issues the maintainers labelled both platform:linux and area:sandbox.
197 issues · 62 open · 135 resolved (69%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is holding steady. 74 new reports in the last 90 days vs 72 in the 90 before — +3%. The open backlog peaked at 62 in 2026-10 and sits at 62 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
151 of these reports name the Claude Code build they were running, spanning 95 releases. Heaviest reporters:
- Claude Code v2.1.263
- Claude Code v2.1.236
- Claude Code v2.1.283
- Claude Code v2.1.114
- Claude Code v2.1.296
- Claude Code v2.1.280
- Claude Code v2.1.259
- Claude Code v2.1.232
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 135 closures. Of the 135 closures with a recorded reason, 27% were closed as completed and 99 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
87 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- The only real workaround that I found: 1) Install via npm: npm install -g @anthropic-ai/claude-code@latest 2) Fix executable bit: chmod +x <npm-prefix /lib/node modules/@anthropic-ai/claude-code/vendor/seccomp/x64/apply-…
Found in the thread of #43454 · still open - Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- …n for any agent workflow that stages before committing. The workaround (always stage explicit paths) is only discoverable by hitting the error. None of it is documented: never mentions stub files, protected-path artifact…
Found in the description of #78419 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved - Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- …thread , if the helper's entry point can run early enough. Workarounds, for anyone else hitting this What we shipped: a small wrapper early on that rewrites the prefix to run under first. util-linux is single-threaded,…
Found in the description of #86928 · still open - [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- …at mount setup rather than at exec), but confirms does not work around this class of bug. Root cause (per 69583, still applicable in 2.1.289) The sandbox setup binds (and other allow-listed paths) into the new mount nam…
Found in the description of #99680 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–100
Ranked by community engagement (reactions weighted over comments).
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- Sandbox sets TMPDIR=/tmp/claude but writable dir is /tmp/claude-$UID
- Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- [BUG] 2.1.277: excludedCommands "every part must match" also drops single commands carrying a pre-subcommand flag (git -C, -c, --git-dir)
- [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- `grep -r` with `--include` filters falsely triggers `Read(.env)` deny prompt (v2.1.259) — breaks every recursive search
- [BUG] Sandbox fails with "bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted" on Ubuntu 25.10 / kernel 6.17 (still broken, ref #14719)
- [BUG] Standalone CLI binary missing seccomp binaries — /doctor reports "seccomp not available"
- Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- [BUG] `apply-seccomp` binary loses execute bit after auto-update (Linux)
- [BUG] ENV_SCRUB=1 sandbox leaves persistent 0-byte placeholder files in cwd AND $HOME (.netrc, .bashrc, .gitconfig) — still in v2.1.211
- [BUG] Bash tool: exit 126 with "permission denied: /proc/self/fd/3" on Fedora 43 + zsh, blocks git writes, `ls -la`, `gh`
- sandbox.excludedCommands does not bypass network restrictions (SSH blocked for git)
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- [BUG] bwrap fails in a worktree when .claude/skills is a symlink in a repository
- Sandbox sets TMPDIR to non-existent directory, causing child processes to hang
- sandbox.enabled: false setting ignored — bwrap still wraps all Bash commands
- Bash sandbox (bubblewrap) corrupts `!` to `\!` in commands, making the sandbox unusable for agentic workflows
- [BUG] bwrap sandbox completely broken — "Can't create file at .zshrc: Read-only file system" kills ALL Bash tool calls
- sandbox.filesystem.denyWrite/denyRead silently ignore relative paths; only absolute paths work
- Sandbox crashes when auto-denied file paths traverse symlinks
- [BUG] sandbox auto-allow does not work vor env-prefixed commands
- v2.1.98 regression: rw bind mounts inside ~/.claude shadowed by parent ro mount
- [BUG] Bash sandbox fails to initialize on Ubuntu 24.04+ - conflict with the distro's default bwrap-userns-restrict AppArmor profile (not a Claude Code regression)
- [BUG] Cowork sandbox: unlink(2) returns EPERM on owned files, breaks .git lock cleanup
- [Feature Request] Support GPG commit signing in sandboxed environment
- [BUG] sandbox.enabled: false does not disable bwrap when working directory is ~/.claude/
- [BUG] 2.1.283: sandbox.excludedCommands never unsandboxes aws calls with --profile or --endpoint-url (Linux)
- [BUG] Ink rendering crash "<Box> can't be nested inside <Text>" when teammate requests sandbox bypass permission
- sandbox filesystem denyRead not enforced for Read tool or Bash commands
- [BUG] sandbox denyRead seems ineffective
- [BUG] Sandbox startup error on Linux shows unrendered `${j$}` instead of the failing sandbox component
- [BUG] Sandbox fails inside Docker containers: nested user namespace in apply-seccomp causes EACCES on /proc/self/setgroups
- [BUG] Pipes silently broken in sandbox: shell-quoted "<" in oAD passes literal argument to eval instead of redirect
- [Bug] filesystem.denyRead not merged with Read(...) deny permissions in sandbox
- [BUG] Sandbox deny rules with mid-path globs cause E2BIG on Linux — per-file bwrap expansion instead of per-directory overlay
- Sandbox filesystem rules can't scope to git root, breaking worktree workflows
- Worktree isolation refuses git-free Bash on 2.1.272/2.1.273: literal-assigned variables, $(…) args, loops, heredocs after && (75 refusals in 3 days)
- Sandbox bind-mounts /dev/null device nodes in working directory, breaking Python build tools
- [BUG] claude --continue aborts on Linux 2.1.120 with `sandbox required but unavailable: ${j$}` (unfilled template literal)
- sandbox.enabled: false ignored at runtime; allowWrite emits doubled path prefix (2.1.116)
- bwrap launcher uses --bind for optional hardware paths (/opt/cuda*); fails on systems without CUDA installed
- claude plugin eval: every Bash call fails on stock Ubuntu (apply-seccomp setgroups, #43454) and the sandbox settings workaround cannot be applied
- Bash tool fails on every command: bwrap can't mkdir /run/containerd/containerd.sock (Permission denied)
- [BUG] sandbox.enableWeakerNestedSandbox silently forced to false when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set (breaks Bash sandbox in cap-dropped nested Docker)
- [BUG] Permission prompts fire inside sandbox-allowed paths, training users to add permissions.allow entries that genuinely bypass the sandbox
- [Bug] Claude Code blocks credential-based API calls due to overly restrictive safety filters, the existence of "Auto Mode " and "Goal" is surrendered
- [BUG] Sandbox bwrap fails when ~/.nix-profile exists as a symlink to a directory
- [BUG] `sandbox.filesystem.denyRead` silently bypassed when target is inside a `denyWrite` directory
- Sandbox mode leaves read-only bind mounts that persist after disable
- [DOCS] Sandboxing docs missing Linux subprocess isolation and `CLAUDE_CODE_SCRIPT_CAPS`
- [BUG] Specifying `Edit(filepath)` in `permissions.deny` whilst also specifying the filepath in `denyWrite` for `sandbox` causes bwrap failures on all bash tool calls
- excludedCommands in sandbox config does not bypass bwrap filesystem restrictions
- [Bug] Sandboxed shell commands freeze typing when executed in directories with many files
- Sandbox wedges on merged-usr Linux: bwrap "Can't mount tmpfs on /newroot/bin" (regression, works on 2.1.229)
- Sandbox blocks inbound SSO/OAuth loopback callback from Bash-tool CLI commands (Linux/WSL2)
- Claude Code binary silently disables transparent huge pages (THP)
- [Bug] Experimental CreateTeam: peer agents not inheriting workspace auto-approval for sandbox bash and repo filesystem operations
- [BUG] Sandbox allowRead glob patterns silently fail when any directory contains a symlink loop
- [BUG] Sandbox doesn't work when ~/.claude/settings.json is read-only symlink to nix-store
- [BUG] `**/` glob prefix in deny rules causes massive context bloat on Linux/WSL but not macOS
- [BUG] Sandbox suggestion from the docs breaks Bash's working dir
- [BUG] aarch64 linux (al2023) bash tool process spawning completely broken
- [BUG] Can't change tabs in /sandbox command
- [BUG] [Linux/Sandbox] bubblewrap creates persistent 0-byte read-only stub files in .claude/ of other projects
- [BUG] Linux sandbox: filesystem.allowRead on a symlink inside a denyRead directory has no effect
- [BUG] Browser pane still blocks same-origin subresources on DDEV's *.ddev.site (public DNS → 127.0.0.1) after #86362 fix; *.test works
- Worktree-isolation guard: string-executor check matches every argument position, case-insensitively
- Per-tool-call helper process (claude.exe) leaks to 11.6GB anon RSS and is OOM-killed during a slow sandboxed Bash command
- Sandbox: bwrap fails when auto-generated .env deny path resolves through symlink into read-only /nix/store
- Sandboxed Bash fails with "bwrap: Can't create file at .git: Is a directory" in normal (non-worktree) git repos
- [BUG] Sandbox recursively enumerates workspace into nested node_modules → unbounded memory → OOM (still repros on 2.1.195; cf #27863)
- sandbox.enabled: true triggers a synchronous full-tree directory walk on startup → multi-minute hang in large workspaces
- Sandboxed Bash commands get a spurious backslash before `!` (shell-quote re-escapes the eval wrapper)
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- [BUG] Bash tool dispatch with sandbox stalls 8-16s between permission decision and shell spawn; UI frozen during stall
- [BUG] model anchors on dangerouslyDisableSandbox: true and keeps applying it to unrelated read-only commands
- sandbox.excludedCommands not honored — adb/fastboot still run inside the sandbox namespace
- [Bug] Sandbox initialization fails on Linux: missing apply-seccomp helper in v2.1.98+
- [BUG] Title: Bash tool: third-party CLI binaries silently fail (exit 1, no output) even with dangerouslyDisableSandbox: true
- Sandbox allowWrite treats absolute paths as relative to ~/.claude/
- excludedCommands does not bypass network sandbox for SSH/git operations
- Worktree isolation refuses a quoted heredoc whose body has a quote inside braces ("too complex to verify"), 2.1.280
- [BUG] In strict sandbox mode, non-literal paths force permission prompts even in Auto mode
- Linux/WSL2 sandbox: socat proxy bridge starts in the background, so the first network call in a command fails
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- Sandboxed Bash wedges permanently when the working directory is on a read-only filesystem (no cwd recovery)
- [BUG] `sandbox.network.strictAllowlist` has no effect — Bash tool dispatcher never invokes bwrap, on any tested version
- Bash sandbox intermittently fails with apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- [BUG] startup performs multiple full working-tree walks that bypass .gitignore
- [BUG] sandbox.filesystem.denyWithinAllow not enforced for Edit/Write tools
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- [BUG] Built-in bwrap sandbox: launch races transient git lockfiles under a shared `.git` → bwrap exits 1 "Can't get type of source .../config.lock"
- [BUG] bgIsolation containment check isn't realpath-canonicalized; symlinked cwd bypasses it
- bwrap sandbox crashes on fresh project dirs: 'Can't create file at <cwd>/.claude/settings.json: Read-only file system'
- Claude Code ran rm -rf against $HOME due to env var not persisting between Bash tool calls, deleting Downloads/Documents/Pictures/.config