Sandbox apply-seccomp setgroups failure

“Bug report draft: Claude Code Linux sandbox fails with apply-seccomp setgroups error”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/claude-code/issues/1942/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Fading. 5 reports and thumbs-up in the last 7 days and 8 the week before. A workaround is known.

Sandboxed Bash commands fail with apply-seccomp setgroups error on Ubuntu 26.04. Commands exit before running with "nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN"; one report names AppArmor's bwrap-userns-restrict profile as the cause.

Is this your bug?

File my report

Where: Linux sandbox
Error text: apply-seccomp: write /proc/self/setgroups (nested userns is capability-restricted; caller must provide CAP_SYS_ADMIN): Permission denied
Versions: 2.1.283 to 2.1.302
Platforms: Linux
How bad: Some reports say it used to work.

Part of: Linux sandbox fails every command3 bugs

Eval sandbox blocks workspace writes3 people
Sandbox read-only bind breaks Bash3 people

Not quite your bug?

Sandbox bwrap cannot exec bash10 people
Sandbox fails on symlinked paths2 people

Original reports3, newest first

Oct 26, 2026Sandbox fails on Ubuntu 26.04: AppArmor bwrap-userns-restrict profile denies CAP_SYS_ADMIN#105194
Oct 13, 2026Linux sandbox fails: apply-seccomp setgroups "Permission denied" on Ubuntu 26.04#101946
Oct 3, 2026claude plugin eval: every Bash call fails on stock Ubuntu (apply-seccomp setgroups, #43454) and the sandbox settings workaround cannot be applied#99269