[BUG] apply-seccomp fails on Linux - cannot write /proc/self/setgroups

[crazyfrogspb]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

All Bash commands fail in Claude Code 2.1.92 on Ubuntu 25.10 with:
apply-seccomp: write /proc/self/setgroups (nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN): Permission denied

The new apply-seccomp binary (shipped in 2.1.92 per changelog: "Linux sandbox now ships the apply-seccomp helper") writes to /proc/self/setgroups before mapping UID. Tested on kernel 6.17.0-14 and 6.17.0-20, both fail.

What Should Happen?

Bash commands should execute successfully inside the sandbox. The apply-seccomp helper should work on Linux kernel (Ubuntu 25.10). Version 2.1.91 worked fine - no sandbox errors.

Error Messages/Logs

apply-seccomp: write /proc/self/setgroups (nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN): Permission denied

Steps to Reproduce

# This pattern is what apply-seccomp does internally
unshare -U bash -c "echo deny > /proc/self/setgroups"
# → Permission denied

# With UID mapping first - works:
unshare -Ur echo test
# → test

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.91

Claude Code Version

2.1.92

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Downgrading fixes the issue
ln -sf /home/crazyfrogspb/.local/share/claude/versions/2.1.91 /home/crazyfrogspb/.local/bin/claude

[earlzero]

I'm having the same issue.

[trebonius]

To get functional again, I needed to reinstall an older version: $ claude install 2.1.91

[conradoplg]

Does Anthropic even test the sandbox?

[oubeichen]

The issue is that the built-in apply-seccomp file lacks execution permissions.

node_modules/@anthropic-ai/claude-code/vendor/seccomp/{your-arch}/apply-seccomp

For example, on macOS homebrew:
sudo chmod +x /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/vendor/seccomp/*/apply-seccomp

For Linux:
sudo chmod +x /usr/local/lib/node_modules/@anthropic-ai/claude-code/vendor/seccomp/*/apply-seccomp
(or under /usr/bin/...)

Previously, ripgrep made this exact same mistake, yet here we are seeing the same error repeated.

[trebonius]

The issue is that the built-in apply-seccomp file lacks execution permissions.

With the NPM install, it appears to be true that apply-seccomp isn't set to executable, that isn't the cause of the CAP_SYS_ADMIN error we're focused on here. Also the native install method (rather than npm) doesn't appear to have the permission issue. The apply-seccomp call is executing, but hitting an error.

[zhuowei]

I'm guessing this is because Ubuntu has extra restrictions on unprivileged user namespaces: https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#p-99950-unprivileged-user-namespace-restrictions-15

[  154.360212] audit: type=1400 audit(1775844482.839:321): apparmor="DENIED" operation="capable" class="cap" profile="unpriv_bwrap" pid=3458 comm="apply-seccomp" capability=21  capname="sys_admin"

However, the command in that thread to disable that restriction (echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns) did not work for me: I get the same error after running it.

Disabling AppArmor entirely via kernel cmdline did get the sandbox to start, but that severely reduces Ubuntu's security, so I don't want to do that.

(Also, I believe the change that introduced the nested user namespaces in the sandbox was anthropic-experimental/sandbox-runtime@7ee4ac6)

[trebonius]

Anthropic has now released a broken version to the "stable" channel, so I had to turn off auto-update to keep the last working version 2.1.91. I worked with claude extensively to try and find a workaround that didn't involve disabling apparmor or disabling the claude sandbox, and ultimately failed to find anything that worked.