# How to Fix BubbleWrap Sandbox Failures on Ubuntu 24.04+: The AppArmor Fix

> Fix BubbleWrap sandbox failures on Ubuntu 24.04+ with this AppArmor fix. Create a custom profile to grant necessary capabilities and restore sandbox functionality.

- Repository: [Aaddrick/claude-desktop-debian](https://github.com/aaddrick/claude-desktop-debian)
- Tags: how-to-guide
- Published: 2026-04-19

---

**Create an AppArmor profile at `/etc/apparmor.d/bwrap` granting the `userns` capability to BubbleWrap, then reload the profile with `sudo apparmor_parser -r` to resolve sandbox failures on Ubuntu 24.04+.**

Claude Desktop’s Cowork mode relies on BubbleWrap (bwrap) to create lightweight sandboxes for secure code execution. On Ubuntu 24.04 and newer versions, AppArmor’s default restriction on unprivileged user namespaces blocks the sandbox, causing the launcher to fail with "Operation not permitted" errors. This guide explains the detection logic in the `aaddrick/claude-desktop-debian` repository and provides the definitive AppArmor fix to restore BubbleWrap functionality.

## Understanding the AppArmor User Namespace Restriction

Ubuntu 24.04 introduced a security-hardened AppArmor configuration that disables unprivileged user namespaces by default. This restriction, controlled by the `apparmor_restrict_unprivileged_userns` kernel parameter, prevents the BubbleWrap binary from creating the isolated environments required for Cowork mode. When the block is active, any attempt to invoke `bwrap` results in an "Operation not permitted" error, forcing Claude Desktop to fall back to less secure host-based isolation or fail entirely.

## How the Launcher Detects Sandbox Failures

The detection and diagnostic logic resides in [`scripts/launcher-common.sh`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/launcher-common.sh) at lines 698-731. The script performs a proactive sandbox probe before attempting to launch Cowork mode, classifying failures to provide actionable guidance.

### The Sandbox Probe Process

The launcher executes a test command to verify BubbleWrap functionality:

```bash
bwrap --ro-bind / / true

```

This command attempts to create a read-only bind mount of the root filesystem inside a new namespace. If the AppArmor restriction is active, the command fails with exit code 1 and stderr output containing "Operation not permitted".

### Error Classification Logic

The script uses a regex pattern to identify the specific failure cause:

```bash
_userns_re='user[ -_]namespace|apparmor|Operation not permitted|CLONE_NEW|CAP_SYS_ADMIN'

```

When the probe error output matches this pattern, the launcher prints a targeted diagnostic message identifying the Ubuntu 24.04 AppArmor restriction as the likely cause and referencing the troubleshooting documentation.

## Implementing the AppArmor Profile Fix

Resolving the sandbox failure requires creating a custom AppArmor profile that explicitly grants BubbleWrap the `userns` capability. This fix is applied system-wide and persists across reboots.

### Step 1: Create the AppArmor Profile

Create a new profile file at `/etc/apparmor.d/bwrap` with the following content:

```bash
sudo tee /etc/apparmor.d/bwrap <<'EOF'
abi <abi/4.0>,
include <tunables/global>

profile bwrap /usr/bin/bwrap flags=(unconfined) {
    userns,
    include if exists <local/bwrap>
}
EOF

```

This profile uses the `unconfined` flag with the specific `userns` capability, allowing BubbleWrap to create user namespaces while maintaining other AppArmor protections.

### Step 2: Load the Profile

Activate the new AppArmor profile without restarting:

```bash
sudo apparmor_parser -r /etc/apparmor.d/bwrap

```

Alternatively, you can reload all AppArmor profiles with `sudo systemctl reload apparmor` or reboot the system.

## Verifying the Fix

After applying the AppArmor profile, verify that BubbleWrap sandboxing functions correctly using Claude Desktop’s built-in diagnostic tool:

```bash
claude-desktop --doctor

```

The diagnostic output should now display:

```

bubblewrap: sandbox probe succeeded

```

With the sandbox operational, Claude Desktop will use the BubbleWrap backend for Cowork mode, providing lightweight isolation without falling back to the host backend.

**Security Note:** This profile grants the `userns` capability to any process executing `/usr/bin/bwrap`. While this enables the required sandbox functionality, it also allows any user on the system to create unprivileged user namespaces. Review this against your organization’s security policies before deployment.

## Summary

- **Ubuntu 24.04+ blocks unprivileged user namespaces** via the `apparmor_restrict_unprivileged_userns` kernel parameter, preventing BubbleWrap from creating sandboxes.
- **The launcher detects this** in [`scripts/launcher-common.sh`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/launcher-common.sh) (lines 698-731) by probing `bwrap --ro-bind / / true` and matching errors against an AppArmor/namespace regex.
- **The fix requires a custom AppArmor profile** at `/etc/apparmor.d/bwrap` that grants the `userns` capability to `/usr/bin/bwrap`.
- **Verify the resolution** by running `claude-desktop --doctor` and confirming "bubblewrap: sandbox probe succeeded".

## Frequently Asked Questions

### Why does Ubuntu 24.04 block BubbleWrap sandboxes?

Ubuntu 24.04 introduced stricter AppArmor defaults that disable unprivileged user namespaces (`apparmor_restrict_unprivileged_userns=1`) to mitigate potential security vulnerabilities in the kernel’s user namespace implementation. This prevents BubbleWrap from creating the isolated mount and user namespaces required for sandboxing, resulting in "Operation not permitted" errors when the launcher attempts to initialize Cowork mode.

### Is the AppArmor profile fix safe to apply?

The AppArmor profile enables the `userns` capability specifically for `/usr/bin/bwrap`, allowing any user to invoke BubbleWrap and create unprivileged user namespaces. While this is necessary for Claude Desktop’s Cowork mode to function, it removes the system-wide restriction that Ubuntu 24.04 enforces by default. You should review this against your security requirements; the profile limits the capability to the BubbleWrap binary rather than enabling it globally, which reduces risk compared to disabling the restriction entirely via kernel parameters.

### How can I verify the sandbox is working without running Claude Desktop?

You can manually test BubbleWrap functionality by running the same probe command used by the launcher: execute `bwrap --ro-bind / / true` in your terminal. If the command returns silently with exit code 0, the sandbox is functional. If you receive "Operation not permitted" or similar errors, the AppArmor restriction is still active. Alternatively, run `claude-desktop --doctor` to see the launcher’s detailed diagnostic output, which explicitly reports whether the bubblewrap probe succeeded or failed.

### What happens if I don't apply the AppArmor fix?

Without the AppArmor profile, Claude Desktop’s launcher detects the sandbox failure in [`scripts/launcher-common.sh`](https://github.com/aaddrick/claude-desktop-debian/blob/main/scripts/launcher-common.sh) and either falls back to the less restrictive "host" backend or disables Cowork mode entirely. The host backend executes code without namespace isolation, reducing security guarantees. You will also see warning messages in the terminal and diagnostic output indicating that the bubblewrap sandbox probe failed, directing you to apply the AppArmor fix to restore full sandbox functionality.