What's Wrong?
When Claude Code v2.1.98+ refuses to start because the sandbox can't initialise on Linux, the error message contains an unrendered JavaScript template literal:
Error: sandbox required but unavailable: ${j$}
sandbox.failIfUnavailable is set — refusing to start without a working sandbox.
The ${j$} is a minified variable name (j$) that should have been interpolated — presumably the failing sandbox component (bwrap, landlock, seccomp, etc.) or its exit detail. Users see literal ${j$} instead of useful context.
Why This Matters
The error blocks startup completely — no project loads, no --help from inside the REPL, nothing. Without the missing variable there's no signal pointing at:
- Which sandbox component failed
- What the underlying syscall / exit code was
- Where to look for the fix
In my case the actual cause was Ubuntu 24.04's kernel.apparmor_restrict_unprivileged_userns=1 default blocking bwrap from creating user namespaces (well-documented in #17727, fix in this comment). I only worked it out by SSH'ing in from another tool and asking it to diagnose. A first-time user without a backup would be stuck.
Suggested Fixes
Two scoped, separable asks:
-
Fix the template literal substitution so ${j$} becomes the actual failing-component name. Whatever's stopping the variable from being interpolated (minifier interaction? closure capture? String.raw somewhere?) is itself the bug — the surrounding error path looks correct.
-
Make the error actionable on Linux. When bwrap exits with Permission denied during uid map setup and /proc/sys/kernel/apparmor_restrict_unprivileged_userns reads 1 (both cheap to detect at startup), include a one-line pointer in the error message — e.g. "On Ubuntu 24.04+, bubblewrap requires an AppArmor profile to create user namespaces — see [docs link]."
Reproduction
- Fresh Ubuntu 24.04 LTS with the default
apparmor_restrict_unprivileged_userns=1
apt install bubblewrap (yields 0.9.0)- Install Claude Code v2.1.98+ (reproduced on v2.1.120)
- Run
claude from any directory
- Observe error with unrendered
${j$} and no recovery hint
Environment
- Claude Code: 2.1.120
- OS: Ubuntu 24.04 LTS
- Kernel: 6.8.0-110-generic
- bubblewrap: 0.9.0
- AppArmor LSM: enabled
kernel.apparmor_restrict_unprivileged_userns: 1 (Ubuntu 24.04 default)kernel.unprivileged_userns_clone: 1
Related
What's Wrong?
When Claude Code v2.1.98+ refuses to start because the sandbox can't initialise on Linux, the error message contains an unrendered JavaScript template literal:
The
${j$}is a minified variable name (j$) that should have been interpolated — presumably the failing sandbox component (bwrap, landlock, seccomp, etc.) or its exit detail. Users see literal${j$}instead of useful context.Why This Matters
The error blocks startup completely — no project loads, no
--helpfrom inside the REPL, nothing. Without the missing variable there's no signal pointing at:In my case the actual cause was Ubuntu 24.04's
kernel.apparmor_restrict_unprivileged_userns=1default blockingbwrapfrom creating user namespaces (well-documented in #17727, fix in this comment). I only worked it out by SSH'ing in from another tool and asking it to diagnose. A first-time user without a backup would be stuck.Suggested Fixes
Two scoped, separable asks:
Fix the template literal substitution so
${j$}becomes the actual failing-component name. Whatever's stopping the variable from being interpolated (minifier interaction? closure capture?String.rawsomewhere?) is itself the bug — the surrounding error path looks correct.Make the error actionable on Linux. When
bwrapexits withPermission deniedduring uid map setup and/proc/sys/kernel/apparmor_restrict_unprivileged_usernsreads1(both cheap to detect at startup), include a one-line pointer in the error message — e.g. "On Ubuntu 24.04+, bubblewrap requires an AppArmor profile to create user namespaces — see [docs link]."Reproduction
apparmor_restrict_unprivileged_userns=1apt install bubblewrap(yields 0.9.0)claudefrom any directory${j$}and no recovery hintEnvironment
kernel.apparmor_restrict_unprivileged_userns: 1 (Ubuntu 24.04 default)kernel.unprivileged_userns_clone: 1Related