{"version":"2.1.304","anchor":"new-sandbox-setting-allownestedusernamespaces","canonical_anchor":"new-sandbox-setting-allownestedusernamespaces","heading":"Linux sandbox blocks nested user namespaces by default, with a new allowNestedUserNamespaces setting","tier":"use","area":"Sandbox","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304\/e\/new-sandbox-setting-allownestedusernamespaces","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.304","markdown":"### Linux sandbox blocks nested user namespaces by default, with a new allowNestedUserNamespaces setting\n\nOn Linux, sandboxed commands can no longer create user namespaces unless allowNestedUserNamespaces is set, and credential deny rules are hardened\n\n**What**\n\nThe sandbox is a protected space where Claude Code runs commands with limited access to your files. On Linux it is built with a tool called bubblewrap (`bwrap`). A user namespace is a Linux feature that lets a program set up its own isolated view of the system, and a sandboxed command that creates one can undo the sandbox's write denies, the rules that stop it writing to certain files.\n\n- A new optional sandbox setting, `allowNestedUserNamespaces`, defaults to false. Setting it lets sandboxed commands create their own user namespaces, which browser sandboxes, rootless podman or nested bubblewrap need. Its description warns that this gives up the write denies against a hostile command.\n\n- Unless that setting is on or a seccomp helper (a separate system-call filter) is in use, the sandbox adds `--disable-userns` when the installed bubblewrap supports it.\n\n- To find out, Claude Code runs the bubblewrap binary with `--help`, waits up to 5 seconds, looks for `--disable-userns` in the output, and remembers the answer for each binary path.\n\n- Commands are prefixed with `SRT_ALLOW_NESTED_USERNS=1` or `=0` so the sandbox can apply the choice.\n\n- If neither protection is available, Claude Code warns that bubblewrap needs version 0.8.0 or later, must not be setuid, and must not use `enableWeakerNestedSandbox`, and that a command creating a user namespace can undo the write denies.\n\n- Deny rules for credential files are now tracked separately and are no longer reopened by `allowRead` or write paths. Placeholders for deny paths that do not exist were reworked, and mandatory deny rules are now returned and counted.\n\n**Why**\n\nThis closes a route by which a sandboxed command on Linux could escape its write restrictions. If you run browsers, podman or nested bubblewrap inside the sandbox, you now need `allowNestedUserNamespaces`, at a real security cost.\n\n- Area: Sandbox\n- Names: `sandbox.allowNestedUserNamespaces`\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: yes"}