claude-code - 💡(How to fix) Fix [BUG] Sandbox doesn't work when ~/.claude/settings.json is read-only symlink to nix-store [1 participants]

! ls -la  ~/.claude/settings.json
  ⎿  lrwxrwxrwx 1 arian users 84 Apr 23 21:43 /home/arian/.claude/settings.json -> /nix/store/9gfvbr7vmj2vsqisakvi9vxs7p3i0lzl-home-manager-files/.claude/settings.json

! cat ~/.claude/settings.json
  ⎿  {
       "$schema": "https://json.schemastore.org/claude-code-settings.json",
       "permissions": {
         "allow": [
           "Bash(jj log)",
           "Bash(jj st)",
           "Bash(jj diff)",
     "Bash(jj root)"
         ],
         "deny": [
     "Bash(git *)"
         ]
       },
       "sandbox": {
         "enabled": true,
         "failIfUnavailable": true,
         "filesystem": {
           "allowRead": [
             ".",
             "/nix/store",
     "/nix/var/nix/daemon-socket/socket"
           ],
           "allowWrite": [
             ".",
     "/nix/var/nix/daemon-socket/socket"
           ],
           "denyRead": [
     "/"
           ],
           "denyWrite": [
     "/"
           ]
         },
         "network": {
           "allowAllUnixSockets": true,
           "allowedDomains": [
             "cache.nixos.org",
     "channels.nixos.org"
           ]
         }
       }
     }

---

● Bash(curl -s https://github.com | head -5)
  ⎿  Error: Exit code 1
     bwrap: Can't create file at /home/arian/.claude/settings.json: No such file or directory

● Blocked by the sandbox — bwrap (bubblewrap) denied the network access. That confirms the distinction: local Bash calls are sandboxed, WebFetch is not.

❯ nah it fails for antoehr reason

● Right — the actual error is bwrap: Can't create file at /home/arian/.claude/settings.json: No such file or directory. The bubblewrap sandbox setup itself is failing
  because /home/arian/.claude/settings.json doesn't exist, which bwrap needs to set up the sandbox. That's the real blocker, not a network rule for github.com.

! ls ~/.claude/settings.json
  ⎿  /home/arian/.claude/settings.json

! ls -la  ~/.claude/settings.json
  ⎿  lrwxrwxrwx 1 arian users 84 Apr 23 21:43 /home/arian/.claude/settings.json -> /nix/store/9gfvbr7vmj2vsqisakvi9vxs7p3i0lzl-home-manager-files/.claude/settings.json

❯ ● Right — the actual error is bwrap: Can't create file at /home/arian/.claude/settings.json: No such file or directory. The bubblewrap sandbox setup itself is
  failing
    because /home/arian/.claude/settings.json doesn't exist, which bwrap needs to set up the sandbox. That's the real blocker, not a network rule for github.com.

  ! ls ~/.claude/settings.json
    ⎿  /home/arian/.claude/settings.json

  ! ls -la  ~/.claude/settings.json
    ⎿  lrwxrwxrwx 1 arian users 84 Apr 23 21:43 /home/arian/.claude/settings.json ->
  /nix/store/9gfvbr7vmj2vsqisakvi9vxs7p3i0lzl-home-manager-files/.claude/settings.json
   but it does

● The file exists but it's a symlink into /nix/store (read-only). bwrap likely tries to bind-mount or create an overlay for that path as part of sandbox setup, but
  can't because the target is in the immutable Nix store. That's what causes the failure.

---

{ pkgs, lib, ... }:
{
  programs.claude-code = {
    enable = true;
    settings = {
      sandbox = {
        enabled = true;
        failIfUnavailable = true;
        filesystem = {
          denyWrite = [ "/" ];
          denyRead = [ "/" ];
          allowRead = [
            "."
            "/nix/store"
            "/nix/var/nix/daemon-socket/socket"
          ];
          allowWrite = [
            "."
            "/nix/var/nix/daemon-socket/socket"
          ];
        };
        network = {
          allowUnixSockets = lib.mkIf pkgs.stdenv.hostPlatform.isDarwin [ "/nix/var/nix/daemon-socket/socket" ];
          allowAllUnixSockets = pkgs.stdenv.hostPlatform.isLinux;
          allowedDomains = [
            "cache.nixos.org"
            "channels.nixos.org"
          ];
        };
      };
      permissions = {
        deny = [ "Bash(git *)" ];
        allow = [
          "Bash(jj log)"
          "Bash(jj st)"
          "Bash(jj diff)"
          "Bash(jj root)"
        ];
      };
    };
  };
}