Sandbox sets TMPDIR to non-existent directory, causing child processes to hang

[ieggel]

Description

When running in sandbox mode, Claude Code sets TMPDIR=/tmp/claude and adds /tmp/claude to the filesystem write allowlist — but never actually creates the directory. Since /tmp itself is read-only within the sandbox, the directory cannot be created from inside the sandbox either.

This causes any tool that spawns child processes relying on os.tmpdir() (Node.js) or $TMPDIR for temp files, IPC, or worker communication to silently hang.

Steps to reproduce

1. Start Claude Code in sandbox mode (fresh session or after reboot, so /tmp/claude doesn't exist)
2. Run any command that uses worker threads/child processes needing temp files — e.g., npm run test in a project using vitest

Observed behavior

• TMPDIR is set to /tmp/claude and inherited by child processes
• /tmp/claude does not exist as a directory
• mkdir -p /tmp/claude fails from within the sandbox with Read-only file system (because /tmp is not writable, only /tmp/claude is in the allowlist)
• Child processes (e.g., vitest worker threads) attempt to write IPC/temp files to the non-existent directory and block indefinitely
• Commands hang with no error message

Expected behavior

The sandbox should create the TMPDIR directory on startup before any commands are executed, since it cannot be created from within the sandbox.

Workaround

Manually create the directory with sandbox disabled:

mkdir -p /tmp/claude

This persists until reboot (since /tmp is typically tmpfs).

Environment

• Platform: Linux (Ubuntu, kernel 6.8.0-106-generic)
• Note: The sandbox also creates and uses /tmp/claude-1000/ which does exist — the inconsistency suggests /tmp/claude creation was simply missed

[yurukusa]

This is a chicken-and-egg problem — the sandbox allows writes to /tmp/claude but /tmp itself is read-only, so mkdir /tmp/claude fails.

MARKER="/tmp/claude-tmpdir-checked-${CLAUDE_SESSION_ID:-$$}"
[ -f "$MARKER" ] && exit 0
touch "$MARKER" 2>/dev/null
TMPDIR=${TMPDIR:-/tmp/claude}
if [ ! -d "$TMPDIR" ]; then
  mkdir -p "$TMPDIR" 2>/dev/null || true
fi
exit 0

// ~/.claude/settings.json
{
  "env": {
    "TMPDIR": "/tmp"
  }
}

This points TMPDIR back to the writable /tmp directory. Note: this may interact with sandbox restrictions depending on your configuration.

[ieggel]

Thanks @yurukusa, but what i really wanted here is the Claude Team to take note and implement a permanent fix

[ashwin-ant]

This was fixed in v2.1.101 — The sandbox now creates its TMPDIR before launching commands, so child processes that write to $TMPDIR no longer hang or fail. If you're still seeing this in the latest version, please comment with your version and repro and we'll reopen.