1 00:00:00,160 --> 00:00:00,700 Picture this. 2 00:00:01,240 --> 00:00:05,820 You've got the Bash sandbox switched on, you ask Claude to run your browser tests, 3 00:00:06,200 --> 00:00:09,440 and Chromium falls over before it opens a single page. 4 00:00:10,120 --> 00:00:15,540 That's the itch a new setting in Claude Code 2.1.305 scratches. 5 00:00:16,200 --> 00:00:20,460 This is The Claude Code Changelog, brought to you by Jellypod AI. 6 00:00:20,940 --> 00:00:21,420 I'm Lachlan. 7 00:00:22,140 --> 00:00:22,820 And I'm James. 8 00:00:23,580 --> 00:00:30,260 Version 2.1.305 came out on October 20, 2026, and it adds a Linux sandbox setting 9 00:00:30,300 --> 00:00:33,560 called sandbox dot allowNestedUserNamespaces. 10 00:00:34,120 --> 00:00:38,880 It applies to Linux and WSL2, where the built-in Bash sandbox is built on bubblewrap 11 00:00:38,900 --> 00:00:39,520 and socat. 12 00:00:40,180 --> 00:00:44,180 Bubblewrap creates an unprivileged user namespace to wall off the commands Claude 13 00:00:44,260 --> 00:00:44,600 runs. 14 00:00:45,220 --> 00:00:49,920 The problem was that child processes needing their own user namespace failed inside 15 00:00:49,960 --> 00:00:50,420 that wall. 16 00:00:51,040 --> 00:00:55,380 Two big cases: headless Chromium, which uses user namespaces for its own internal 17 00:00:55,460 --> 00:00:59,480 browser sandbox, so think Playwright, Puppeteer or Cypress suites. 18 00:00:59,980 --> 00:01:04,560 And rootless container tools like Podman and Buildah, which need namespaces to map 19 00:01:04,640 --> 00:01:05,960 unprivileged user IDs. 20 00:01:06,815 --> 00:01:08,215 So what did people do before? 21 00:01:08,835 --> 00:01:11,215 Mostly two things, and both were a bit grim. 22 00:01:11,855 --> 00:01:16,955 You added the tool to sandbox.excludedCommands, which runs those commands completely 23 00:01:17,035 --> 00:01:19,495 outside the sandbox, full host access. 24 00:01:20,115 --> 00:01:24,415 Or you turned the sandbox off, or went all the way to the dangerously skip 25 00:01:24,455 --> 00:01:25,395 permissions flag. 26 00:01:26,095 --> 00:01:29,955 Either way you traded your whole safety net for one flaky test runner. 27 00:01:30,635 --> 00:01:35,195 The official docs even say that excluded commands have no filesystem restrictions 28 00:01:35,595 --> 00:01:37,075 and no network proxy. 29 00:01:37,813 --> 00:01:39,573 Right, so now there's a middle path. 30 00:01:40,253 --> 00:01:41,073 Here's how you use it. 31 00:01:41,593 --> 00:01:48,333 In your settings file, either user level at ~/.claude/settings.json or project level 32 00:01:48,413 --> 00:01:54,553 at .claude/settings.json, you set sandbox enabled to true, and sandbox 33 00:01:54,713 --> 00:01:57,153 allowNestedUserNamespaces to true. 34 00:01:57,793 --> 00:02:01,833 If you just want to try it for one session, you can pass the same JSON inline with 35 00:02:01,853 --> 00:02:02,733 the settings flag. 36 00:02:03,133 --> 00:02:07,753 Something like claude, then the settings flag, then a JSON string with sandbox, 37 00:02:07,913 --> 00:02:11,073 enabled true, allowNestedUserNamespaces true. 38 00:02:11,673 --> 00:02:12,673 No file edits needed. 39 00:02:13,687 --> 00:02:19,687 And a practical tip: if you're on Ubuntu 24.04 or later and the sandbox won't start 40 00:02:19,727 --> 00:02:21,447 at all, that's a different issue. 41 00:02:22,047 --> 00:02:26,727 The docs say the default AppArmor policy can stop bubblewrap creating user 42 00:02:26,787 --> 00:02:31,147 namespaces, and they give you an AppArmor profile for bwrap to fix it. 43 00:02:32,087 --> 00:02:35,427 This new setting is about the processes INSIDE the sandbox, 44 00:02:35,747 --> 00:02:36,867 not bubblewrap itself. 45 00:02:37,588 --> 00:02:38,208 Good distinction. 46 00:02:38,768 --> 00:02:40,888 Now the caveat, and it's a big one. 47 00:02:41,328 --> 00:02:45,988 Anthropic's own changelog entry says, and I'm quoting, that this lets those commands 48 00:02:46,048 --> 00:02:48,348 get around the sandbox's file protections. 49 00:02:48,908 --> 00:02:52,728 The way to read that: once a child process can make its own namespaces, 50 00:02:52,968 --> 00:02:57,308 it can potentially set up its own mounts and user ID maps, and that can undo the 51 00:02:57,348 --> 00:03:00,688 read only bindings and path protections the sandbox gave you. 52 00:03:01,268 --> 00:03:04,968 That mechanism is our interpretation of the warning, but the warning itself is 53 00:03:05,048 --> 00:03:06,028 straight from the changelog. 54 00:03:06,783 --> 00:03:09,583 So treat it like a trade, not a free lunch. 55 00:03:10,123 --> 00:03:13,823 For your own laptop, running your own test suite, that's probably fine. 56 00:03:14,203 --> 00:03:19,103 But if you're running untrusted code, or unattended CI sessions where filesystem 57 00:03:19,203 --> 00:03:24,243 isolation actually matters, don't lean on the bubblewrap file boundary once this is 58 00:03:24,343 --> 00:03:24,583 on. 59 00:03:25,163 --> 00:03:30,063 Put the whole session in a container or a dedicated microVM instead. 60 00:03:30,783 --> 00:03:34,063 The docs' sandbox environments page lays out those options, 61 00:03:34,483 --> 00:03:39,083 and it also notes the Bash sandbox alone isn't enough for fully unattended runs. 62 00:03:39,950 --> 00:03:40,810 Okay, quick hits. 63 00:03:41,350 --> 00:03:44,810 First, if you run Claude through Amazon Bedrock, Google Vertex, 64 00:03:44,970 --> 00:03:50,670 or a corporate gateway: 2.1.304 had a regression where every request failed if the 65 00:03:50,730 --> 00:03:53,150 endpoint or gateway rejected tool search. 66 00:03:53,830 --> 00:03:55,630 2.1.305 fixes it. 67 00:03:56,090 --> 00:03:58,130 Claude Code now retries without tool search. 68 00:03:58,910 --> 00:04:05,770 And in 2.1.304 tool search became on by default behind a custom ANTHROPIC_BASE_URL, 69 00:04:06,290 --> 00:04:08,430 so that retry matters if you sit behind a gateway. 70 00:04:09,150 --> 00:04:11,350 Second, /usage got handy. 71 00:04:11,870 --> 00:04:15,030 Each warning is now a one line fix that names where it came from, 72 00:04:15,450 --> 00:04:17,170 and pressing f applies the fixes. 73 00:04:17,749 --> 00:04:20,990 Same fixes show up in VS Code and in /doctor. 74 00:04:21,850 --> 00:04:25,490 Third, for unattended retry mode, there's a new environment variable, 75 00:04:26,010 --> 00:04:33,210 CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS. 76 00:04:33,850 --> 00:04:38,470 It lets CLAUDE_CODE_RETRY_WATCHDOG notice that a usage limit was lifted before its 77 00:04:38,550 --> 00:04:42,790 scheduled reset, so your overnight job doesn't sit around waiting for no reason. 78 00:04:43,613 --> 00:04:45,333 Fourth, full disk errors. 79 00:04:45,713 --> 00:04:50,673 Bash commands that hit a full disk used to show a raw ENOSPC file path. 80 00:04:51,113 --> 00:04:54,233 Now the message says the disk is full and that nothing ran, 81 00:04:54,433 --> 00:04:56,393 which is the bit you actually need to know. 82 00:04:57,313 --> 00:05:04,033 And a hotfix, 2.1.306, fixes an API error getting replaced by a misleading prompt is 83 00:05:04,113 --> 00:05:09,333 too long message, plus an unneeded compaction, in sessions with lots of MCP tools. 84 00:05:09,833 --> 00:05:14,253 It also fixes claude dash p in cloud sessions saying not logged in. 85 00:05:15,168 --> 00:05:20,228 So the takeaway: if your sandboxed browser tests or rootless Podman were the reason 86 00:05:20,268 --> 00:05:23,868 you punched holes in your sandbox, try the new setting instead, 87 00:05:24,448 --> 00:05:26,688 and keep that file protection warning in mind. 88 00:05:27,348 --> 00:05:30,328 Update to 2.1.306 while you're at it.