Run Chromium and Rootless Podman in Claude Code’s Linux Sandbox

Lachlan Reed

Picture this. You've got the Bash sandbox switched on, you ask Claude to run your browser tests, and Chromium falls over before it opens a single page. That's the itch a new setting in Claude Code 2.1.305 scratches. This is The Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan.

James Turner

And I'm James. Version 2.1.305 came out on October 20, 2026, and it adds a Linux sandbox setting called sandbox dot allowNestedUserNamespaces. It applies to Linux and WSL2, where the built-in Bash sandbox is built on bubblewrap and socat. Bubblewrap creates an unprivileged user namespace to wall off the commands Claude runs. The problem was that child processes needing their own user namespace failed inside that wall. Two big cases: headless Chromium, which uses user namespaces for its own internal browser sandbox, so think Playwright, Puppeteer or Cypress suites. And rootless container tools like Podman and Buildah, which need namespaces to map unprivileged user IDs.

Lachlan Reed

So what did people do before? Mostly two things, and both were a bit grim. You added the tool to sandbox.excludedCommands, which runs those commands completely outside the sandbox, full host access. Or you turned the sandbox off, or went all the way to the dangerously skip permissions flag. Either way you traded your whole safety net for one flaky test runner. The official docs even say that excluded commands have no filesystem restrictions and no network proxy.

James Turner

Right, so now there's a middle path. Here's how you use it. In your settings file, either user level at ~/.claude/settings.json or project level at .claude/settings.json, you set sandbox enabled to true, and sandbox allowNestedUserNamespaces to true. If you just want to try it for one session, you can pass the same JSON inline with the settings flag. Something like claude, then the settings flag, then a JSON string with sandbox, enabled true, allowNestedUserNamespaces true. No file edits needed.

Lachlan Reed

And a practical tip: if you're on Ubuntu 24.04 or later and the sandbox won't start at all, that's a different issue. The docs say the default AppArmor policy can stop bubblewrap creating user namespaces, and they give you an AppArmor profile for bwrap to fix it. This new setting is about the processes INSIDE the sandbox, not bubblewrap itself.

James Turner

Good distinction. Now the caveat, and it's a big one. Anthropic's own changelog entry says, and I'm quoting, that this lets those commands get around the sandbox's file protections. The way to read that: once a child process can make its own namespaces, it can potentially set up its own mounts and user ID maps, and that can undo the read only bindings and path protections the sandbox gave you. That mechanism is our interpretation of the warning, but the warning itself is straight from the changelog.

Lachlan Reed

So treat it like a trade, not a free lunch. For your own laptop, running your own test suite, that's probably fine. But if you're running untrusted code, or unattended CI sessions where filesystem isolation actually matters, don't lean on the bubblewrap file boundary once this is on. Put the whole session in a container or a dedicated microVM instead. The docs' sandbox environments page lays out those options, and it also notes the Bash sandbox alone isn't enough for fully unattended runs.

James Turner

Okay, quick hits. First, if you run Claude through Amazon Bedrock, Google Vertex, or a corporate gateway: 2.1.304 had a regression where every request failed if the endpoint or gateway rejected tool search. 2.1.305 fixes it. Claude Code now retries without tool search. And in 2.1.304 tool search became on by default behind a custom ANTHROPIC_BASE_URL, so that retry matters if you sit behind a gateway.

Lachlan Reed

Second, /usage got handy. Each warning is now a one line fix that names where it came from, and pressing f applies the fixes. Same fixes show up in VS Code and in /doctor. Third, for unattended retry mode, there's a new environment variable, CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS. It lets CLAUDE_CODE_RETRY_WATCHDOG notice that a usage limit was lifted before its scheduled reset, so your overnight job doesn't sit around waiting for no reason.

James Turner

Fourth, full disk errors. Bash commands that hit a full disk used to show a raw ENOSPC file path. Now the message says the disk is full and that nothing ran, which is the bit you actually need to know. And a hotfix, 2.1.306, fixes an API error getting replaced by a misleading prompt is too long message, plus an unneeded compaction, in sessions with lots of MCP tools. It also fixes claude dash p in cloud sessions saying not logged in.

Lachlan Reed

So the takeaway: if your sandboxed browser tests or rootless Podman were the reason you punched holes in your sandbox, try the new setting instead, and keep that file protection warning in mind. Update to 2.1.306 while you're at it.