Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeReleasesv2.1.305entry #79

Claude Code v2.1.305 ·

Turning on nested user namespaces in the sandbox is now a reason to refuse

Claude Code now refuses an action when sandbox.allowNestedUserNamespaces is on, because it lets commands get around file deny rules

You'll notice Improvements
JSON All of v2.1.305
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.305,
ImprovementsSection of the release

Unclear It is not clear which action is refused when this setting is on.

What

When sandbox.allowNestedUserNamespaces is set to true, Claude Code now stops with the message "sandbox.allowNestedUserNamespaces lets sandboxed commands get around file deny rules". It sits alongside an existing refusal tied to sandbox.network.allowManagedDomainsOnly. File deny rules are the rules that keep commands away from files they must not touch.

Why

This setting weakens the sandbox, so with it on, something that relies on the sandbox may refuse to go ahead.

Read from
Names in the bundlesandbox.allowNestedUserNamespacessandbox.network.allowManagedDomainsOnly
What the documentation says
Documented inclaude-code/monitoring-usage
Since it was published

The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.

Added since A small documentation edit on Agent SDK reference - TypeScript touched a line naming sandbox.allowNestedUserNamespaces after this was published. | `allowNestedUserNamespaces` | `boolean` | `false` | Let sandboxed commands on Linux and WSL2 create user namespaces. Before you set it to `true`, read [`sandbox.allowNestedUserNamespaces`](/docs/en/settings-reference#sandbox-allownestedu… agent-sdk/typescript see the edit
Confirmed since Anthropic's documentation has since written up sandbox.allowNestedUserNamespaces, on Configure the sandboxed Bash tool. * To keep Chromium's or Electron's own sandbox, or to run a nested bubblewrap or `unshare`, set [`sandbox.allowNestedUserNamespaces`](/docs/en/settings-reference#sandbox-allownestedusernamespaces) to `true` in `~/.claude/settings.json`, no… sandboxing see the edit
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtIt is not clear which action is refused when this setting is on.
Anthropic's documentation agreesAnthropic's documentation has since written up sandbox.allowNestedUserNamespaces, on Configure the sandboxed Bash tool.
Anthropic's release notes agreeAdded sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces (Chromium, rootless podman); this lets…

See this entry in the whole of v2.1.305 →

Feedback