The sandbox issues on WSL
Issues the maintainers labelled both platform:wsl and area:sandbox.
62 issues · 19 open · 43 resolved (69%) · first seen Feb 25, 2026
Is this getting better or worse?
This class of problem is still growing. 25 new reports in the last 90 days vs 16 in the 90 before — +56%. The open backlog peaked at 19 in 2026-10 and sits at 19 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
44 of these reports name the Claude Code build they were running, spanning 39 releases. Heaviest reporters:
- Claude Code v2.1.289
- Claude Code v2.1.280
- Claude Code v2.1.116
- Claude Code v2.1.114
- Claude Code v2.1.63
- Claude Code v2.1.296
- Claude Code v2.1.293
- Claude Code v2.1.283
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 33 days across 43 closures. Of the 43 closures with a recorded reason, 33% were closed as completed and 29 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
26 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- …at mount setup rather than at exec), but confirms does not work around this class of bug. Root cause (per 69583, still applicable in 2.1.289) The sandbox setup binds (and other allow-listed paths) into the new mount nam…
Found in the description of #99680 · still open - [BUG] 2.1.277: excludedCommands "every part must match" also drops single commands carrying a pre-subcommand flag (git -C, -c, --git-dir)
- …I have not confirmed it on the first-party API or Bedrock. Workaround. Change directory in its own command, then run plain : Note that is not a workaround — that is genuinely a compound command, so the 2.1.277 rule corr…
Found in the description of #95455 · still open - Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- …n is dropped — this would at least make the directory-level workaround effective. 4. Guardrail. Detect when the generated bind argv would exceed / and emit a clear diagnostic (which glob expanded to how many paths) inste…
Found in the description of #74081 · still open - `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- …ntically relevant (e.g. from a prompt that passes via env). Workarounds require rewriting commands to read env values separately and inline them, which is not always feasible for generated tool calls. Likely 2.1.113 prov…
Found in the description of #51001 · resolved - [BUG] WSL2: Bash tool fails with E2BIG because Claude wraps bubblewrap in single /bin/bash -c string exceeding Linux MAX_ARG_STRLEN
- …Observe: the tool call fails immediately with and . Minimal workaround confirmed: collapsing to a single broad entry (e.g. ) with narrow carve-outs for the binaries/caches/paths actually needed reduces bwrap argv below t…
Found in the description of #51126 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–62
Ranked by community engagement (reactions weighted over comments).
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [BUG] bwrap: execvp /bin/bash: No such file or directory — sandbox completely broken on all merged-usr Linux distros (Debian/Ubuntu/Arch), still unfixed after 3+ prior reports (#41863, #69583, #88059, #64799)
- [BUG] 2.1.277: excludedCommands "every part must match" also drops single commands carrying a pre-subcommand flag (git -C, -c, --git-dir)
- Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- [BUG] Sandbox not activating on WSL2 despite enabled in settings and all dependencies installed
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- Sandbox materializes & persists .git/config.lock in linked worktrees, blocking git config writes
- [BUG] WSL2: Bash tool fails with E2BIG because Claude wraps bubblewrap in single /bin/bash -c string exceeding Linux MAX_ARG_STRLEN
- Sandbox masks nonexistent deny-listed paths as unreadable device nodes - breaks plain git whenever `extensions.worktreeConfig` is enabled
- Sandbox filesystem rules can't scope to git root, breaking worktree workflows
- [BUG] recent seccomp change for /sandbox broke executing Windows tools from WSL
- Worktree isolation refuses git-free Bash on 2.1.272/2.1.273: literal-assigned variables, $(…) args, loops, heredocs after && (75 refusals in 3 days)
- [BUG] Claude code freezes when running in sandbox (WSL)
- [BUG] Network Sandbox in WSL intermittent failures
- [BUG] Claude Code silently rewrites user-provided relative path into fabricated absolute Windows path in transcript
- excludedCommands in sandbox config does not bypass bwrap filesystem restrictions
- Worktree isolation refuses every pwsh/powershell/cmd invocation with any argument; git-as-path-segment also refused inside interpreter text
- Sandbox blocks inbound SSO/OAuth loopback callback from Bash-tool CLI commands (Linux/WSL2)
- [FEATURE] Allow user override of sandbox auto-deny on .claude/skills/ (currently hard-coded in 2.1.x)
- [BUG] Claude Code v2.1.144 silently exits immediately on launch when bubblewrap/socat are missing
- [BUG] Sandbox Config tab filesystem restrictions dropping leading slash on WSL2
- [BUG] `**/` glob prefix in deny rules causes massive context bloat on Linux/WSL but not macOS
- Session-level permission caching bypasses allow list for Bash commands when sandbox mode is enabled
- [BUG] Sandbox creates directories in CWD from Bash tool command arguments when command is not found
- [BUG] sandbox.filesystem.allowWrite paths not applied to Bash tool (rm, mv, etc.) — only Write/Edit tools
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- [BUG] Bash tool fails with /proc/self/fd/3: Permission denied after a few calls in 2.1.116 and 2.1.117
- [BUG] WSL2 Sandbox bwrap fails to mount ~/.aws when symlinked to inaccessible path
- Linux/WSL2 sandbox: socat proxy bridge starts in the background, so the first network call in a command fails
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- [BUG] Worktree isolation classifies git `-C`/`--git-dir`/`--work-tree` paths by leading character: refuses `.` and `~` inside the worktree, allows `$VAR` that escapes it
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- [Bug] Bash tool lacks resource limits, causing OOM/hang on large file operations
- [BUG] No sandbox warning in terminal
- CWD is polluted with empty boundary files at every session start (package.json, yarn.lock, .env.*, etc.)
- [BUG] Sandbox fails when denyRead paths don't exist: bwrap can't mount tmpfs on non-existent directory
- EnterWorktree: a stale/empty worktree directory silently resolves to the parent repo, so "isolated" commits land on the parent's checked-out branch
- [BUG] Claude Code freezes from time to time for almost 2 minutes on some operations on WSL2 since version 2.1.149
- [DOCS] [sandbox] sandbox.bwrapPath and sandbox.socatPath managed settings undocumented for Linux/WSL
- [DOCS] clarify allowUnixSockets brokering across the sandbox netns
- [BUG] Sandbox TMPDIR /tmp/claude not created — ENOENT after fresh boot
- Sandbox mode: files created by background agents via Bash don't persist to real filesystem
- [BUG] Sandbox cannot create its own TMPDIR: /tmp/claude allowlisted but /tmp is not writable
- [BUG] Working directory shown in session header does not match actual pwd output
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- [Bug] Segmentation fault in seccomp binary on Windows WSL2 after update
- [BUG] Sandbox sets TMPDIR=/tmp/claude but directory doesn't exist and /tmp is read-only
- [BUG] sandbox.network.allow hosts still prompt for network access
- [BUG]
- [BUG] WSL2: a read-deny path symlinked into /mnt/c fails bwrap for every Bash command, and is unremovable when it comes from managed settings
- A non-string entry in sandbox.filesystem.denyRead/denyWrite silently disables permissions.deny and PreToolUse hooks (2.1.261)
- [BUG] Bash sandbox (bwrap) fails intermittently with different errors each run on WSL2 + Docker Engine — race condition, not a permissions issue
- Project-level settings.local.json sandbox config ignored in Desktop-app (claude-desktop entrypoint) sessions
- sandbox.enabled: true causes unbounded memory growth at startup, OOM (2.1.233-2.1.235, WSL2)
- isolation:"worktree" subagents: Edit tool silently writes into the PARENT session's worktree (+ git-guard root misattribution, pristine-worktree auto-reap orphans cwd into parent tree)
- Built-in Bash sandbox: network isolation unreliable on WSL2; failIfUnavailable doesn't detect a non-enforcing proxy
- [BUG] CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 makes .git/worktrees read-only on Linux: git worktree add and commits in linked worktrees fail
- [BUG] claude plugin eval refuses Bash-granting cases on WSL2: Docker Desktop's ~/.docker/contexts symlink is not in the pre-flight skip set
- ArtifactData out_dir is refused under any path segment named .claude, including the $CLAUDE_JOB_DIR/tmp the runtime recommends
- [BUG] Linux sandbox leaks claude-empty-* mount-source directories in the temp dir (never removed)
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)
- [Data Loss] Claude Code ran rm -rf on $HOME in auto mode — destructive code hidden inside a script the assistant wrote itself (5th report of this class)