What
On Linux, the sandbox uses a program called bubblewrap. If the system setting kernel.apparmor_restrict_unprivileged_userns is turned on, Claude Code now runs a short bubblewrap test. AppArmor is a Linux security feature that can stop bubblewrap from working. If the test fails with one of the errors this setting causes, Claude Code gives a specific fix, either:
- add bubblewrap's AppArmor profile, as described at https://code.claude.com/docs/en/sandboxing
- change the setting with
sysctland restart
Why
On systems such as Ubuntu 24.04 where this setting is on by default, a sandbox that will not start now comes with a fix you can act on rather than an unexplained failure.
Names in the bundlekernel.apparmor_restrict_unprivileged_userns
Documented inclaude-code/sandboxing