The sandbox issues on Linux — page 2
Issues the maintainers labelled both platform:linux and area:sandbox.
150 issues · 35 open · 115 resolved (77%) · first seen Feb 24, 2026
Is this getting better or worse?
This class of problem is converging. 57 new reports in the last 90 days vs 86 in the 90 before — -34%. The open backlog peaked at 42 in 2026-04 and sits at 35 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
109 of these reports name the Claude Code build they were running, spanning 73 releases. Heaviest reporters:
- Claude Code v2.1.114
- Claude Code v2.1.232
- Claude Code v2.1.179
- Claude Code v2.1.119
- Claude Code v2.1.112
- Claude Code v2.1.97
- Claude Code v2.1.92
- Claude Code v2.1.236
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 115 closures. Of the 115 closures with a recorded reason, 30% were closed as completed and 80 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
64 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups
- The only real workaround that I found: 1) Install via npm: npm install -g @anthropic-ai/claude-code@latest 2) Fix executable bit: chmod +x <npm-prefix /lib/node modules/@anthropic-ai/claude-code/vendor/seccomp/x64/apply-…
Found in the thread of #43454 · still open - Sandbox stubs break `git add .` and are indistinguishable from real repo state to the agent
- …n for any agent workflow that stages before committing. The workaround (always stage explicit paths) is only discoverable by hitting the error. None of it is documented: never mentions stub files, protected-path artifact…
Found in the description of #78419 · still open - [Bug] v2.1.117 regression: parallel Bash tool calls corrupt fd 3 in nested-Docker sandbox; permanent /proc/self/fd/3: Permission denied
- …, or timing. Filing what I've reproduced deterministically. Workaround Possibly related - 2.1.113 introduced the switch from "bundled JS" to "native Claude Code binary" per its release notes. The native binary's sandbox…
Found in the description of #51837 · resolved - Sandboxed Bash intermittently fails: apply-seccomp: unshare(CLONE_NEWUSER): Invalid argument
- …thread , if the helper's entry point can run early enough. Workarounds, for anyone else hitting this What we shipped: a small wrapper early on that rewrites the prefix to run under first. util-linux is single-threaded,…
Found in the description of #86928 · still open - [BUG] bwrap sandbox broken on merged-usr systems (Arch): "Can't mount tmpfs on /newroot/lib64" — enableWeakerNestedSandbox does not fix it, MCP servers fail to start
- …o NOT fix it: sandbox.enabled: false FWIW, for me this does work around it. Of course this results in no sandboxing being applied, but it allows me to use Claude CLI for now. If I set that to I immediately get the issue…
Found in the thread of #64799 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 101–150
Ranked by community engagement (reactions weighted over comments).
- Feature: Landlock sandbox directives for PreToolUse hooks
- [BUG] Shell tool is returning no output in arch
- [DOCS] [sandbox] sandbox.bwrapPath and sandbox.socatPath managed settings undocumented for Linux/WSL
- [BUG] v2.1.131 native binary hangs on input with seccomp filter in Docker container — ioctl blocked
- [BUG] claude code can't access external projects if running via sandboxed environment
- [BUG] regression: 2.1.120: ERROR UKH is not a function. Error: sandbox required but unavailable
- [BUG] sandbox mode with --resume crashes UI
- Outer sandbox blocks /run-codex-review: need per-command bypass or broader default allowWrite for bundled codex plugin
- cli.js sandbox arch resolver hard-codes x64/arm64 only — blocks ppc64le even when apply-seccomp is present
- CLAUDE_CODE_SUBPROCESS_ENV_SCRUB silently overrides sandbox.enabled:false with no warning
- CLAUDE_CODE_SUBPROCESS_ENV_SCRUB silently overrides sandbox.enabled:false with no warning
- [DOCS] clarify allowUnixSockets brokering across the sandbox netns
- UX: defaultMode: bypassPermissions does not imply sandbox-off — easy to miss, breaks every in-project build
- Sandbox creates empty ~/.bash_profile in $HOME, breaks login shell PATH
- [BUG] Sandbox TMPDIR /tmp/claude not created — ENOENT after fresh boot
- [Bug] Bash AST parser warning bypasses sandbox auto-approve mode
- [BUG] Silverblue compatibility bug in Cowork/Claude Code
- [BUG] Claude silents fails to enter sandbox in non-writable directory
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- [BUG] Bash tool sandbox broken on Linux after kernel update — bwrap missing --dev /dev
- [BUG] Sandbox sets TMPDIR=/tmp/claude but directory doesn't exist and /tmp is read-only
- Linux sandbox replaces /run/user with an empty tmpfs, so sandboxed commands cannot reach the D-Bus session bus or the system keyring — gh breaks and the only workaround is plaintext credentials
- [BUG] Bash tool refused in nested user namespace since 2.1.220: apply-seccomp: write /proc/self/uid_map: Operation not permitted
- [Bug] Sandbox denies write access to $CLAUDE_JOB_DIR/tmp for background agents
- Sandboxed Bash wedges permanently when the working directory is on a read-only filesystem (no cwd recovery)
- [BUG] startup performs multiple full working-tree walks that bypass .gitignore
- Bash sandbox filesystem isolation does not confine on Linux-in-Docker — default allow-list AND deny-list both bypassed (atomic repro; corroborates #32226, #29048)
- [BUG] Built-in bwrap sandbox: launch races transient git lockfiles under a shared `.git` → bwrap exits 1 "Can't get type of source .../config.lock"
- [BUG] 2.1.211 "always allow rules save at repository root" breaks unattended runs in a linked git worktree under a worktree-scoped filesystem sandbox
- bwrap sandbox crashes on fresh project dirs: 'Can't create file at <cwd>/.claude/settings.json: Read-only file system'
- [BUG] Fedora Sandbox with Bubblewrap and Socat Creates Several Stub Files on Startup
- [DOCS] Sandbox docs do not mention the v2.1.179 `denyRead`/`allowRead` glob fix or warn that broad globs over large directory trees can blow up the Bash tool description
- [BUG] Linux: files under a sandbox-reachable directory get enumerated ~one rule per file into the `bash` tool schema, overflowing `/context` "System tools"
- Sandbox network egress broken on Linux: internal socat relay uses TCP-LISTEN (tries IPv6) and dies in --unshare-net namespace
- [BUG] Claude code cannot connect to the internet
- [BUG] Linux sandbox: proxy UNIX sockets not visible to subprocesses (missing bind after --tmpfs /tmp)
- Sandbox deny list grows without bound with registered git worktrees; at ~250 worktrees every Bash command fails with E2BIG
- Worktree isolation verifies complexity, not targets: a simple Bash command writing an absolute path outside the worktree passes unchecked
- Worktree-isolation guard: string-executor check matches every argument position, case-insensitively
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- Sandbox wedges on merged-usr Linux: bwrap "Can't mount tmpfs on /newroot/bin" (regression, works on 2.1.229)
- [BUG] Bash sandbox fails to initialize on Ubuntu 24.04+ - conflict with the distro's default bwrap-userns-restrict AppArmor profile (not a Claude Code regression)
- [BUG] Sandbox network allowlist bypassed via in-sandbox relayed CONNECT (direct CONNECT correctly blocked)
- Sandbox: auto-denied .env paths are not canonicalized, so one symlinked component aborts bwrap and disables all Bash
- Cloud sessions (`/ultraplan` handoff) die on first turn with generic "An error occurred while executing Claude Code" when repo-tracked settings enable sandbox with `failIfUnavailable: true`
- [BUG] bwrap bin/bash not exists
- [BUG] `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1` leaves an empty `~/.bash_profile` behind, silently breaking login-shell PATH
- [Bug] Auto mode executes untrusted scripts with curl
- Auto mode permitted recursive deletion of entire home directory during a docker-compose task (working dir was a subdirectory)