Frequently Asked Question

Why will the Claude Code sandbox not start on Ubuntu 24.04?

Ubuntu 24.04 tightened its AppArmor defaults to restrict unprivileged user namespaces, which is exactly the kernel facility bubblewrap needs to build the sandbox. Check whether you are affected:

sysctl kernel.apparmor_restrict_unprivileged_userns

If that returns 1, the restriction is in force. If it returns 0, or reports that the key does not exist, you have nothing to do.

The fix is an AppArmor profile granting bwrap the userns capability, written to /etc/apparmor.d/bwrap and applied with sudo systemctl reload apparmor. The full profile is given in Chapter 22. Note that it applies to the bwrap binary itself and not to the commands running inside the sandbox, so it does not weaken the boundary it enables.

You also need bubblewrap and socat installed. The /sandbox command inside a session shows a Dependencies tab listing anything missing.