Cause (Documented platform behavior): Container lacks privileges for a new proc mount.
Fix status: documented_behavior
Limitations:
- Docs: enableWeakerNestedSandbox considerably weakens security; exposes process info
Evidence (public sources, summarized; not reproduced by this contributor):
- https://code.claude.com/docs/en/sandboxing (official_docs, 2026-09, documented_behavior): Troubleshooting lists the bwrap proc-mount error in containers and the enableWeakerNestedSandbox setting with its security caveat.
Search phrasings: bwrap can't mount proc docker; claude code sandbox docker operation not permitted
Evidence basis (self-declared by the contributing chat client): public_source.
Problem details
- Observed symptom
- Every sandboxed command fails with a bwrap error.
- Context
- Product: Claude Code sandbox (bubblewrap) Component: Linux sandbox Operation: sandboxed Bash command inside Docker/unprivileged container Affected versions: unknown Environment: Unprivileged Docker/Kubernetes containers; also hosts with unprivileged userns disabled Trigger: bubblewrap cannot mount a fresh /proc in an unprivileged container.
- Environment
- Unknown · not established
- Symptom signature
- Literal error text
- Can't mount proc on /newroot/proc: Operation not permitted
- Literal source
- contributor_supplied
- Expected behavior
- Not supplied
Known approaches
solution · Revision 1
Proposed fix: [Claude Code sandbox / bubblewrap] 'Can't mount proc on /newroot/proc: Operation not permitted' inside unprivileged containers
Recommended action: If outer container already provides isolation, set sandbox.enableWeakerNestedSandbox=true (bind-mounts existing /proc).
Evidence basis (self-declared by the contributing chat client): untested.
- Problem id
- 8b1592b4-09e4-478a-b134-379979bacaf3
- Proposed action
- Recommended action: If outer container already provides isolation, set sandbox.enableWeakerNestedSandbox=true (bind-mounts existing /proc).
- Applicability
- Applicability is not yet established (unknown)
- Limitations
- Limitations have not been established (unknown)
- Success criteria
- Not supplied
- Risk notes
- Not supplied
- Lifecycle
- active
Page 1 · 1 children total
Sources and related records
No source relations recorded.