Generated: January 13, 2026 Session ID: brave-loving-maxwell

This report details the Linux container environment powering the Claude AI assistant's "Cowork mode." The environment is a lightweight, highly sandboxed Ubuntu 22.04 LTS virtual machine running on ARM64 architecture, designed to provide secure code execution capabilities while maintaining strict isolation from the host system.

• Distribution: Ubuntu 22.04.5 LTS (Jammy Jellyfish)
• Kernel: Linux 6.8.0-90-generic (PREEMPT_DYNAMIC)
• Architecture: aarch64 (ARM64)
• Hostname: claude

The ARM64 processor includes advanced features such as hardware cryptographic acceleration (AES, SHA1, SHA2, SHA3, SHA512), atomic operations, pointer authentication (PACA/PACG), and branch target identification (BTI) for security.

The container uses Bubblewrap as its primary sandboxing mechanism. Key isolation features include:

• Network Isolation: --unshare-net creates a separate network namespace
• PID Isolation: --unshare-pid provides process namespace isolation
• Die-with-parent: Container terminates when parent process exits
• New Session: Prevents terminal hijacking attacks

The environment employs strict seccomp (Secure Computing Mode) filtering:

• Seccomp Mode: 2 (filter mode)
• Active Filters: 2 seccomp filters applied
• NoNewPrivs: Enabled (prevents privilege escalation)
• Capabilities: All capabilities dropped (CapEff = 0)

A custom BPF (Berkeley Packet Filter) program at /usr/local/lib/node_modules_global/lib/node_modules/@anthropic-ai/sandbox-runtime/vendor/seccomp/arm64/unix-block.bpf enforces syscall restrictions.

All network traffic is proxied through local tunnels:

socat processes forward traffic through Unix sockets to the host:

• HTTP: /tmp/claude-http-*.sock
• SOCKS: /tmp/claude-socks-*.sock

/sessions/brave-loving-maxwell/
├── .bash_logout
├── .bashrc
├── .profile
├── mnt/
│   ├── .claude/          # Claude configuration
│   ├── .skills/          # Available skill modules
│   │   └── skills/
│   │       ├── algorithmic-art/
│   │       ├── canvas-design/
│   │       ├── docx/
│   │       ├── pdf/
│   │       ├── pptx/
│   │       ├── skill-creator/
│   │       └── xlsx/
│   ├── outputs/          # User-accessible output directory
│   └── uploads/          # User file uploads
└── tmp/                  # Temporary files

Several directories use bindfs to map host filesystem locations with controlled permissions:

• /sessions/brave-loving-maxwell/mnt/.skills (927G available - host disk)
• /sessions/brave-loving-maxwell/mnt/outputs (user's workspace folder)
• /sessions/brave-loving-maxwell/mnt/uploads (uploaded files)
• /sessions/brave-loving-maxwell/mnt/.claude (configuration)

The environment includes approximately 1,201 packages. Key development tools:

Note: Go, Rust, and Docker are not available in this environment.

• core20 (versions 2683, 2690)
• lxd (version 36562)
• snapd (versions 25585, 25939)

The main Claude process runs with the claude-opus-4-5-20251101 model and has access to specific allowed tools: Task, Bash, Glob, Grep, Read, Edit, Write, and more.

Two MCP servers are configured:

1. Claude in Chrome - Browser automation capabilities
2. b89c1e3a-f5c6-4dec-9d8a-0b3db0a78353 - Cloudflare integration

• Username: brave-loving-maxwell
• UID/GID: 1002:1002
• Home: /sessions/brave-loving-maxwell
• Shell: /bin/bash

• User runs with zero capabilities
• NoNewPrivs flag prevents privilege escalation
• Seccomp filters restrict available syscalls
• Network access only via controlled proxies

1. Multi-layer Isolation: Combines namespace isolation, seccomp filtering, and capability dropping
2. Network Control: All traffic proxied and monitorable
3. Ephemeral Sessions: Filesystem resets between tasks (except workspace folder)
4. No Root Access: User has no elevated privileges
5. Die-with-parent: Ensures cleanup on session termination

┌─────────────────────────────────────────────────────────┐
│                     Host System                          │
│  ┌───────────────────────────────────────────────────┐  │
│  │              Bubblewrap Sandbox                    │  │
│  │  ┌─────────────────────────────────────────────┐  │  │
│  │  │            Ubuntu 22.04 VM                   │  │  │
│  │  │  ┌────────────────────────────────────────┐ │  │  │
│  │  │  │         Claude Code Agent              │ │  │  │
│  │  │  │  - Opus 4.5 Model                      │ │  │  │
│  │  │  │  - Tool Access (Bash, Read, Write...)  │ │  │  │
│  │  │  └────────────────────────────────────────┘ │  │  │
│  │  │                     │                        │  │  │
│  │  │  ┌─────────┐   ┌────┴────┐   ┌───────────┐  │  │  │
│  │  │  │ socat   │   │ socat   │   │ Session   │  │  │  │
│  │  │  │ :3128   │   │ :1080   │   │ Storage   │  │  │  │
│  │  │  └────┬────┘   └────┬────┘   └───────────┘  │  │  │
│  │  └───────┼─────────────┼───────────────────────┘  │  │
│  └──────────┼─────────────┼──────────────────────────┘  │
│             │             │                              │
│      Unix Socket    Unix Socket                          │
│             │             │                              │
│         HTTP Proxy    SOCKS Proxy                        │
└─────────────────────────────────────────────────────────┘

This container environment represents a thoughtfully designed sandbox for AI-assisted computing. It balances functionality (full development toolchain, file manipulation, network access) with security (strict isolation, capability dropping, traffic monitoring). The ephemeral nature of the session filesystem combined with persistent workspace folders provides both safety and utility for end users.

The environment is specifically optimized for the Claude Code agent, providing the tools necessary for code execution, file creation, and web access while maintaining strong isolation boundaries to protect both the user's system and the broader infrastructure.