{"version":"2.1.305","anchor":"sandbox-refuses-a-setting-that-lets-commands-bypass-file-den","canonical_anchor":"sandbox-refuses-a-setting-that-lets-commands-bypass-file-den","heading":"Turning on nested user namespaces in the sandbox is now a reason to refuse","tier":"notice","area":"Sandbox","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/sandbox-refuses-a-setting-that-lets-commands-bypass-file-den","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### Turning on nested user namespaces in the sandbox is now a reason to refuse\n\nClaude Code now refuses an action when `sandbox.allowNestedUserNamespaces` is on, because it lets commands get around file deny rules\n\n**Unclear.** It is not clear which action is refused when this setting is on.\n\n**What**\n\nWhen `sandbox.allowNestedUserNamespaces` is set to true, Claude Code now stops with the message \"sandbox.allowNestedUserNamespaces lets sandboxed commands get around file deny rules\". It sits alongside an existing refusal tied to `sandbox.network.allowManagedDomainsOnly`. File deny rules are the rules that keep commands away from files they must not touch.\n\n**Why**\n\nThis setting weakens the sandbox, so with it on, something that relies on the sandbox may refuse to go ahead.\n\n- Area: Sandbox\n- Names: `sandbox.allowNestedUserNamespaces`, `sandbox.network.allowManagedDomainsOnly`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}