The sandbox issues on Linux — page 2
Issues the maintainers labelled both platform:linux and area:sandbox.
197 issues · 62 open · 135 resolved (69%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is holding steady. 74 new reports in the last 90 days vs 72 in the 90 before — +3%. The open backlog peaked at 62 in 2026-10 and sits at 62 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
151 of these reports name the Claude Code build they were running, spanning 95 releases. Heaviest reporters:
- Claude Code v2.1.263
- Claude Code v2.1.236
- Claude Code v2.1.283
- Claude Code v2.1.114
- Claude Code v2.1.296
- Claude Code v2.1.280
- Claude Code v2.1.259
- Claude Code v2.1.232
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 34 days across 135 closures. Of the 135 closures with a recorded reason, 27% were closed as completed and 99 as not-planned or duplicate. The most recent completed fix landed in 2026-10.
Workarounds reported by the community
87 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- The only real workaround that I found: 1) Install via npm: npm install -g @anthropic-ai/claude-code@latest 2) Fix executable bit: chmod +x <npm-prefix /lib/node modules/@anthropic-ai/claude-code/vendor/seccomp/x64/apply-…
Found in the thread of #43454 · still open - Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- …n for any agent workflow that stages before committing. The workaround (always stage explicit paths) is only discoverable by hitting the error. None of it is documented: never mentions stub files, protected-path artifact…
Found in the description of #78419 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved - Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- …thread , if the helper's entry point can run early enough. Workarounds, for anyone else hitting this What we shipped: a small wrapper early on that rewrites the prefix to run under first. util-linux is single-threaded,…
Found in the description of #86928 · still open - [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- …at mount setup rather than at exec), but confirms does not work around this class of bug. Root cause (per 69583, still applicable in 2.1.289) The sandbox setup binds (and other allow-listed paths) into the new mount nam…
Found in the description of #99680 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–197
Ranked by community engagement (reactions weighted over comments).
- [BUG] claude cli insists on writing /tmp/claude-1000
- [BUG] There is no indication to the user when Claude sets `dangerouslyDisableSandbox: true`
- [BUG] sandbox.filesystem の deny bind-mount が Bash コマンド終了後も残存・累積する（解除に sudo umount が必要）
- Regression: sandbox no longer blocks commands not in excludedCommands (default-deny model broken)
- [BUG] No sandbox warning in terminal
- Slash-command skills with !`...` frontmatter expansions fail to load when sandbox cannot create network namespace
- Sandbox bind-mounts of nonexistent deny-listed paths appear as untracked files in git status
- [Bug] Sandbox unavailable error when sandbox.failIfUnavailable is enabled
- Sandbox cgroup silently disables transparent huge pages (THP)
- Sandbox/bwrap fails in git worktrees: Can't create file at .claude/commands
- bwrap: Can't mount devpts on first sandbox invocation inside rootless podman/Docker container
- [Bug] socat presence causes bwrap sandbox to fail silently or error on Ubuntu
- [BUG] Sandbox fails when denyRead paths don't exist: bwrap can't mount tmpfs on non-existent directory
- [BUG] Sandbox silently prevents cmake/ninja builds without error on Linux
- BPF sandbox does not propagate user command rejections as session-scoped blocklist rules
- [BUG] sandbox.enabled: true silently ignored when socat is not installed (security risk)
- [BUG] Sandbox + `httpProxyPort` enabled, but Claude cannot access HTTP endpoint (`Connection refused`)
- Config save creates lock/temp files in ~/ which breaks sandboxed environments
- Bug: bwrap sandbox binds protected paths snapshotted at session start; deleting one mid-session breaks all later Bash
- [BUG] Linux sandbox: bwrap mount-point cleanup is per-process with no cross-process refcount — concurrent sessions in one project root kill each other's Bash calls
- bwrap sandbox for the Bash tool binds the entire /home directory, causing Permission denied on writes outside the invoking users own home (e.g. /home/.mcp.json)
- sandbox.enabled leaves $TMPDIR read-only when CLAUDE_CODE_TMPDIR is set
- Sandbox deny list grows without bound with registered git worktrees; at ~250 worktrees every Bash command fails with E2BIG
- Bash sandbox filesystem isolation does not confine on Linux-in-Docker — default allow-list AND deny-list both bypassed (atomic repro; corroborates #32226, #29048)
- [BUG] 2.1.211 "always allow rules save at repository root" breaks unattended runs in a linked git worktree under a worktree-scoped filesystem sandbox
- [BUG] `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` leaves an empty `~/.bash_profile` behind, silently breaking login-shell PATH
- [BUG] Fedora Sandbox with Bubblewrap and Socat Creates Several Stub Files on Startup
- [DOCS] Sandbox docs do not mention the v2.1.179 `denyRead`/`allowRead` glob fix or warn that broad globs over large directory trees can blow up the Bash tool description
- [BUG] Linux: files under a sandbox-reachable directory get enumerated ~one rule per file into the `bash` tool schema, overflowing `/context` "System tools"
- Sandbox network egress broken on Linux: internal socat relay uses TCP-LISTEN (tries IPv6) and dies in --unshare-net namespace
- [BUG] Claude code cannot connect to the internet
- Feature request: sandbox GPU/CUDA access via --dev-bind for /dev/nvidia* device nodes
- [BUG] Linux sandbox: proxy UNIX sockets not visible to subprocesses (missing bind after --tmpfs /tmp)
- [BUG] Running claude in a folder with a .git folder without rwx permissions for the current user prevents running bash commands
- [BUG] Sandboxed warning only appears if project on .claude/projects/* doesnt exists
- Feature: Landlock sandbox directives for PreToolUse hooks
- [BUG] Shell tool is returning no output in arch
- [DOCS] [sandbox] sandbox.bwrapPath and sandbox.socatPath managed settings undocumented for Linux/WSL
- [BUG] v2.1.131 native binary hangs on input with seccomp filter in Docker container — ioctl blocked
- [BUG] claude code can't access external projects if running via sandboxed environment
- [BUG] regression: 2.1.120: ERROR UKH is not a function. Error: sandbox required but unavailable
- [BUG] sandbox mode with --resume crashes UI
- Outer sandbox blocks /run-codex-review: need per-command bypass or broader default allowWrite for bundled codex plugin
- CLAUDE_CODE_SUBPROCESS_ENV_SCRUB silently overrides sandbox.enabled:false with no warning
- CLAUDE_CODE_SUBPROCESS_ENV_SCRUB silently overrides sandbox.enabled:false with no warning
- [DOCS] clarify allowUnixSockets brokering across the sandbox netns
- UX: defaultMode: bypassPermissions does not imply sandbox-off — easy to miss, breaks every in-project build
- Sandbox creates empty ~/.bash_profile in $HOME, breaks login shell PATH
- [BUG] Sandbox TMPDIR /tmp/claude not created — ENOENT after fresh boot
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- [BUG] Silverblue compatibility bug in Cowork/Claude Code
- [BUG] Claude silents fails to enter sandbox in non-writable directory
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- [BUG] Bash tool sandbox broken on Linux after kernel update — bwrap missing --dev /dev
- [BUG] Sandbox sets TMPDIR=/tmp/claude but directory doesn't exist and /tmp is read-only
- Sandbox/permission behaviour changes in patch releases aren't in the CHANGELOG — headless claude -p integrations must re-validate every update
- [BUG] Headless/agent Bash session hard-blocks all filesystem access outside primary working directory (regression — same prompt worked previously)
- Worktree isolation in a background session blocks subagents' Bash commands, even for other repos
- [Bug] File Permission Scope Rules Inconsistent Across Sessions
- [BUG] 2.1.281: CLAUDE_CODE_SUBPROCESS_ENV_SCRUB sandbox denies $HOME/actions-runner, so every Bash call fails on a default self-hosted GitHub Actions runner
- [MODEL] Opus 5 executed rm -rf "$HOME" during test cleanup(57,235 files and 11,315 directories deleted), causing extensive data loss
- [BUG] `sandbox.filesystem.denyWrite` silently ignores rules containing a mid-path wildcard (Linux)
- Linux sandbox replaces /run/user with an empty tmpfs, so sandboxed commands cannot reach the D-Bus session bus or the system keyring — gh breaks and the only workaround is plaintext credentials
- [BUG] Bash tool refused in nested user namespace since 2.1.220: apply-seccomp: write /proc/self/uid_map: Operation not permitted
- [Bug] Sandbox denies write access to $CLAUDE_JOB_DIR/tmp for background agents
- [BUG] Sandbox network allowlist bypassed via in-sandbox relayed CONNECT (direct CONNECT correctly blocked)
- Sandbox: auto-denied .env paths are not canonicalized, so one symlinked component aborts bwrap and disables all Bash
- Cloud sessions (`/ultraplan` handoff) die on first turn with generic "An error occurred while executing Claude Code" when repo-tracked settings enable sandbox with `failIfUnavailable: true`
- [BUG] bwrap bin/bash not exists
- [Bug] Auto mode executes untrusted scripts with curl
- Auto mode permitted recursive deletion of entire home directory during a docker-compose task (working dir was a subdirectory)
- [Bug] Sandbox (bubblewrap) on Fedora allows writes outside allowed paths (~/x, /var/tmp)
- Sandbox launcher leaks proxy credentials (HTTP(S)_PROXY basic-auth) via bwrap --setenv argv pairs, world-readable in /proc/<pid>/cmdline
- [Bug] Linux sandbox fails: apply-seccomp setgroups "Permission denied" on Ubuntu 26.04
- [BUG] CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 makes .git/worktrees read-only on Linux: git worktree add and commits in linked worktrees fail
- [BUG] ENV_SCRUB=1 appends a duplicate "claude-code scrub-mode stubs" block to .git/info/exclude on every session
- [BUG] Linux: sandbox denyRead glob (~/**/.env) now freezes the TUI on every Bash command (regression)
- Linux sandbox leaves a read-only .git/config.lock on the host, breaking git config writes in sibling worktrees
- Local sandbox (bwrap) hangs indefinitely when any unrelated hard-mounted NFS/autofs share is unreachable
- [BUG] claude code can read files outside the project dir without prompting
- [BUG] 2.1.281: scrub sandbox still fails to create ancestor .claude stub when the ancestor is owned by another uid (as root, --cap-drop ALL)
- claude plugin eval: every Bash call fails with "bwrap: loopback: Failed RTM_NEWADDR" (ref #14719, #55585)
- [DOCS] CLAUDE_CODE_SUBPROCESS_ENV_SCRUB requires bubblewrap on Linux and exits at startup without it, but the docs don't say so
- Worktree isolation: a subagent spawned before EnterWorktree has every Bash call refused afterward
- [FEATURE] Sandbox: per-repo egress by host + port + protocol (TCP/UDP); the only built-in route prompts every time
- [BUG] Linux sandbox leaks claude-empty-* mount-source directories in the temp dir (never removed)
- [BUG] Linux: sandboxed Bash permanently dies after EnterWorktree into .claude/worktrees/ (bwrap: Read-only file system)
- sandbox.credentials.files glob expansion costs ~7GB RSS and ~50s on every session start
- [BUG] Agent ran `timeout 5 <electron-app> --version` as a sanity check, orphaned Electron child processes froze the desktop (hard reboot required)
- sandbox credentials.files mask produces no file at all for ~/.config/gh/hosts.yml
- [BUG] Claude Code tried to read file outside current dir to cheat
- Sandboxed Bash fails at apply-seccomp on Ubuntu 24.04 (apparmor_restrict_unprivileged_userns=1): nested userns is capability-restricted
- Sandboxed Bash: "Can't create file at <path>" when permissions.deny Read globs expand to symlink-spelled paths (bind destination uncreatable)
- [BUG] sandbox.credentials.files protection can be bypassed on first access to a not-yet-existing deny-listed path
- Bash tool: ~/.claude is bind-mounted read-only with no way to opt out, so hook state and config-manager writes always fail with EROFS
- Worktree isolation verifies complexity, not targets: a simple Bash command writing an absolute path outside the worktree passes unchecked
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)