Sandboxed hooks on Linux can receive an extra file handle

A hook is a command you configure for Claude Code to run automatically at certain moments. On Linux, Claude Code can run hooks inside a sandbox, which is a walled-off process with limited access to your machine.

When Claude Code first checks whether a hook can be sandboxed, and when it wraps the hook in the sandbox, it can now pass one extra open file handle into the sandboxed process under a certain condition. A file handle is the operating system's reference to an open file or stream. Claude Code releases the handle once it is done. The part of the sandbox that filters system calls works as it did before.