The sandbox issues on WSL
Issues the maintainers labelled both platform:wsl and area:sandbox.
50 issues · 13 open · 37 resolved (74%) · first seen Feb 25, 2026
Is this getting better or worse?
This class of problem is converging. 18 new reports in the last 90 days vs 29 in the 90 before — -38%. The open backlog peaked at 13 in 2026-04 and sits at 13 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
32 of these reports name the Claude Code build they were running, spanning 29 releases. Heaviest reporters:
- Claude Code v2.1.116
- Claude Code v2.1.114
- Claude Code v2.1.63
- Claude Code v2.1.237
- Claude Code v2.1.228
- Claude Code v2.1.233
- Claude Code v2.1.234
- Claude Code v2.1.221
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 32 days across 37 closures. Of the 37 closures with a recorded reason, 38% were closed as completed and 23 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
20 of these issues post a workaround someone says worked. The highest-engagement ones:
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- …ntically relevant (e.g. from a prompt that passes via env). Workarounds require rewriting commands to read env values separately and inline them, which is not always feasible for generated tool calls. Likely 2.1.113 prov…
Found in the description of #51001 · resolved - Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- …n is dropped — this would at least make the directory-level workaround effective. 4. Guardrail. Detect when the generated bind argv would exceed / and emit a clear diagnostic (which glob expanded to how many paths) inste…
Found in the description of #74081 · still open - [BUG] WSL2: Bash tool fails with E2BIG because Claude wraps bubblewrap in single /bin/bash -c string exceeding Linux MAX_ARG_STRLEN
- …Observe: the tool call fails immediately with and . Minimal workaround confirmed: collapsing to a single broad entry (e.g. ) with narrow carve-outs for the binaries/caches/paths actually needed reduces bwrap argv below t…
Found in the description of #51126 · resolved - [BUG] recent seccomp change for /sandbox broke executing Windows tools from WSL
- …ool : No Windows executable can be called from the sandbox. Workarounds Attempted - Adding to in - no effect (blocked at syscall level, not filesystem level) - Adding to - no effect (same reason) - Only workaround is dis…
Found in the description of #45072 · resolved - Sandbox masks nonexistent deny-listed paths as unreadable device nodes - breaks plain git whenever `extensions.worktreeConfig` is enabled
- …ken in the sandbox" with no obvious cause, and the standard workarounds (disable sandbox per-command, or to avoid local git) hide the diagnosis. A second, cosmetic effect: with git working, sandboxed lists the other inje…
Found in the description of #76558 · still open
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–50
Ranked by community engagement (reactions weighted over comments).
- [FEATURE] Linux (bwrap): Add allowUnixSockets / allowAllUnixSockets equivalent for seccomp BPF
- [BUG] Sandbox not activating on WSL2 despite enabled in settings and all dependencies installed
- `--permission-mode dontAsk` bypasses `autoAllowBashIfSandboxed` for Bash commands containing shell variable expansion
- Linux sandbox: recursive Read() deny globs expand to per-file bwrap binds → E2BIG on every command (incl. echo hello) when a denied directory holds many files
- [BUG] WSL2: Bash tool fails with E2BIG because Claude wraps bubblewrap in single /bin/bash -c string exceeding Linux MAX_ARG_STRLEN
- Sandbox filesystem rules can't scope to git root, breaking worktree workflows
- [BUG] recent seccomp change for /sandbox broke executing Windows tools from WSL
- Sandbox masks nonexistent deny-listed paths as unreadable device nodes - breaks plain git whenever `extensions.worktreeConfig` is enabled
- [BUG] Claude code freezes when running in sandbox (WSL)
- [BUG] Claude Code silently rewrites user-provided relative path into fabricated absolute Windows path in transcript
- excludedCommands in sandbox config does not bypass bwrap filesystem restrictions
- [BUG] Network Sandbox in WSL intermittent failures
- [BUG] Claude Code v2.1.144 silently exits immediately on launch when bubblewrap/socat are missing
- [BUG] Sandbox Config tab filesystem restrictions dropping leading slash on WSL2
- [BUG] `**/` glob prefix in deny rules causes massive context bloat on Linux/WSL but not macOS
- Session-level permission caching bypasses allow list for Bash commands when sandbox mode is enabled
- [BUG] Sandbox creates directories in CWD from Bash tool command arguments when command is not found
- [BUG] sandbox.filesystem.allowWrite paths not applied to Bash tool (rm, mv, etc.) — only Write/Edit tools
- Sandbox blocks inbound SSO/OAuth loopback callback from Bash-tool CLI commands (Linux/WSL2)
- Sandbox materializes & persists .git/config.lock in linked worktrees, blocking git config writes
- [FEATURE] Allow user override of sandbox auto-deny on .claude/skills/ (currently hard-coded in 2.1.x)
- [BUG] Bash tool fails with /proc/self/fd/3: Permission denied after a few calls in 2.1.116 and 2.1.117
- [BUG] WSL2 Sandbox bwrap fails to mount ~/.aws when symlinked to inaccessible path
- [BUG] Bash sandbox fabricates phantom unreadable files when a hidden/denyRead path doesn't exist — breaks dotnet/SourceLink builds
- CWD is polluted with empty boundary files at every session start (package.json, yarn.lock, .env.*, etc.)
- [BUG] Sandbox fails when denyRead paths don't exist: bwrap can't mount tmpfs on non-existent directory
- [BUG] Worktree isolation classifies git `-C`/`--git-dir`/`--work-tree` paths by leading character: refuses `.` and `~` inside the worktree, allows `$VAR` that escapes it
- [BUG] Sandbox kills every Bash call in worktrees at the default `.claude/worktrees/` location (bwrap EROFS creating protected-path mountpoints)
- [Bug] Bash tool lacks resource limits, causing OOM/hang on large file operations
- [BUG] No sandbox warning in terminal
- [BUG] Claude Code freezes from time to time for almost 2 minutes on some operations on WSL2 since version 2.1.149
- [DOCS] [sandbox] sandbox.bwrapPath and sandbox.socatPath managed settings undocumented for Linux/WSL
- [DOCS] clarify allowUnixSockets brokering across the sandbox netns
- [BUG] Sandbox TMPDIR /tmp/claude not created — ENOENT after fresh boot
- Sandbox mode: files created by background agents via Bash don't persist to real filesystem
- [BUG] Sandbox cannot create its own TMPDIR: /tmp/claude allowlisted but /tmp is not writable
- [BUG] Working directory shown in session header does not match actual pwd output
- Shell cd is silently reset when navigating outside allowed directories (--add-dir)
- [Bug] Segmentation fault in seccomp binary on Windows WSL2 after update
- [BUG] Sandbox sets TMPDIR=/tmp/claude but directory doesn't exist and /tmp is read-only
- [BUG] sandbox.network.allow hosts still prompt for network access
- Project-level settings.local.json sandbox config ignored in Desktop-app (claude-desktop entrypoint) sessions
- EnterWorktree: a stale/empty worktree directory silently resolves to the parent repo, so "isolated" commits land on the parent's checked-out branch
- Worktree-isolated background sessions: command shape verifier refuses safe read-only commands at scale (0/100 protective in sampled refusals)
- Worktree-isolated sessions: benign read-only command shapes refused as "too complex to verify"; suggested remediation cannot apply to loops
- [BUG] Bash sandbox (bwrap) fails intermittently with different errors each run on WSL2 + Docker Engine — race condition, not a permissions issue
- [Data Loss] Claude Code ran rm -rf on $HOME in auto mode — destructive code hidden inside a script the assistant wrote itself (5th report of this class)
- sandbox.enabled: true causes unbounded memory growth at startup, OOM (2.1.233-2.1.235, WSL2)
- isolation:"worktree" subagents: Edit tool silently writes into the PARENT session's worktree (+ git-guard root misattribution, pristine-worktree auto-reap orphans cwd into parent tree)
- Built-in Bash sandbox: network isolation unreliable on WSL2; failIfUnavailable doesn't detect a non-enforcing proxy