claude-code - 💡(How to fix) Fix Cowork: gvisor network daemon stalls at AcceptBess on every VM boot, causing immediate keepalive failure and session termination

Environment

• Claude Desktop version: 1.3561.0
• macOS version: 26.0.1 (Build 25A362)
• Architecture: Apple Silicon (ARM64)
• Memory: 16 GB (healthy — green pressure bar, 0 bytes swap, ~5 GB cached files free)

Summary

Every Cowork session fails to initialize. The VM boots and connects successfully, OAuth is approved, the SDK installs, and Claude spawns inside the VM — but within ~5 seconds of spawn, all keepalive pings begin timing out and never recover. The session is eventually killed with SIGTERM then SIGKILL.

This affects both resumed and brand-new sessions equally. App restarts do not resolve it. The failure has been 100% reproducible across all attempts starting the evening of April 20, 2026.

Root Cause (Identified)

The gvisor userspace network daemon (vzgvisor) starts successfully but permanently stalls at AcceptBess on every VM boot. The log always ends at the same line and never progresses further:

time="2026-04-20T20:45:23-04:00" level=info msg="usernet: starting with sockFD=97"
time="2026-04-20T20:45:23-04:00" level=info msg="usernet: vmMAC=36:e7:c2:62:11:b9"
time="2026-04-20T20:45:23-04:00" level=info msg="usernet: virtual network created successfully"
time="2026-04-20T20:45:23-04:00" level=info msg="usernet: net.Conn created from socket, type=*net.UnixConn"
time="2026-04-20T20:45:23-04:00" level=info msg="usernet: network stack started successfully"
time="2026-04-20T20:45:23-04:00" level=info msg="usernet: calling AcceptBess..."

This log is identical across multiple VM restarts — the daemon always stalls at the same point. There are no further log entries after calling AcceptBess... regardless of how long it runs.

Because the gvisor network stack never advances past AcceptBess, Claude running inside the VM cannot establish outbound connections to the Anthropic API. The process spawns, attempts network calls, hangs, and the coworkd keepalive vsock channel becomes unresponsive, triggering the desktop app's kill sequence.

Observed Symptom Sequence (from logs)

From cowork_vm_node.log, this pattern repeats identically every attempt:

[VM:start] Startup complete, total time: ~8500ms
[VM] API reachability: REACHABLE
[Keepalive] Starting (interval=2000ms)
[Spawn:vm] OAuth token approved with MITM proxy
[Spawn:vm] Spawn succeeded in ~50ms
[Keepalive] Ping failed: Keep-alive ping timed out   ← starts ~5s after spawn
[Keepalive] Ping failed: Keep-alive ping timed out   ← repeats every 7s indefinitely
[CoworkVMProcess] kill called with signal: SIGTERM
[CoworkVMProcess] waitForVmProcessExit: exit not observed within 5000ms, sending SIGKILL

The Claude process inside the VM does not respond to SIGTERM (it is hung waiting on network I/O) and must be force-killed with SIGKILL every time.

What Works / What Doesn't

Note: The "API reachability: REACHABLE" check apparently uses a path that does not go through gvisor, so it passes even when gvisor is broken.

Additional Context

• The Anthropic status page recorded Cowork-related incidents on April 15, 17, 19, and 20, 2026
• The desktop renderer process reports "coworkKappa":{"status":"unavailable"} in its feature flags at startup
• The issue reproduces for both resumed sessions and newly created sessions
• sessiondata.img (6.1 GB) and rootfs.img (10 GB) are present in vm_bundles/claudevm.bundle/ — the VM bundle appears intact
• No errors appear in coworkd.log inside the VM; the VM reaches the Ubuntu login prompt normally

Steps to Reproduce

1. Open Claude Desktop (v1.3561.0) on macOS 26.0.1 (Apple Silicon)
2. Start any Cowork session (new or resumed)
3. Observe session hang at "Starting up..." or "Working through a complex response..."
4. Check ~/Library/Logs/Claude/vzgvisor.log — will always end at calling AcceptBess...
5. Check ~/Library/Logs/Claude/cowork_vm_node.log — will show continuous keepalive ping timeouts starting ~5 seconds after spawn

Expected Behavior

gvisor should complete AcceptBess, begin handling network traffic from within the VM, and keepalive pings should succeed indefinitely while a session is active.