{"version":"2.1.310","anchor":"sandbox-ubuntu-apparmor-userns-restriction-diagnosed-with-a","canonical_anchor":"sandbox-ubuntu-apparmor-userns-restriction-diagnosed-with-a","heading":"Clearer sandbox error on Ubuntu when AppArmor blocks it","tier":"notice","area":"Sandbox","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.310\/e\/sandbox-ubuntu-apparmor-userns-restriction-diagnosed-with-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.310","markdown":"### Clearer sandbox error on Ubuntu when AppArmor blocks it\n\nOn Linux systems where AppArmor blocks the sandbox, Claude Code now runs a test and gives a specific fix instead of a vague failure\n\n**What**\n\nOn Linux, the sandbox uses a program called bubblewrap. If the system setting `kernel.apparmor_restrict_unprivileged_userns` is turned on, Claude Code now runs a short bubblewrap test. AppArmor is a Linux security feature that can stop bubblewrap from working. If the test fails with one of the errors this setting causes, Claude Code gives a specific fix, either:\n\n- add bubblewrap's AppArmor profile, as described at [https:\/\/code.claude.com\/docs\/en\/sandboxing](https:\/\/code.claude.com\/docs\/en\/sandboxing)\n\n- change the setting with `sysctl` and restart\n\n**Why**\n\nOn systems such as Ubuntu 24.04 where this setting is on by default, a sandbox that will not start now comes with a fix you can act on rather than an unexplained failure.\n\n- Area: Sandbox\n- Names: `kernel.apparmor_restrict_unprivileged_userns`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}