31 tools· updated sep 2026

--dangerously-skip-permissions cannot be used with root/sudo privileges: the fix

Marek.

  • claude-code
  • agent-security
  • agent-ops

Claude Code prints --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons when you start bypass mode as root or under sudo on Linux or macOS. The fix is to run Claude Code as a normal user. The documented dev container does that. Per the docs, the check is skipped inside a recognized sandbox.

# The error, on Linux or macOS
--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons

# Check who you are. 0 means root.
id -u

# Start as a regular user instead of root
claude --dangerously-skip-permissions
  • Where it fires. Linux and macOS, as root or under sudo, in bypassPermissions mode.
  • The fix. A non-root user. In a container, a non-root USER or remoteUser.
  • The workaround people share. IS_SANDBOX=1. It is in GitHub issues, not in the docs.
  • The other string. skipDangerousModePermissionPrompt only records that you accepted the warning dialog. It does not turn bypass on.
  • Where it can live. User, local or managed settings. Not the shared project file.

The full picture of the flag, and what still stops Claude under it, is in my --dangerously-skip-permissions post.

Why does Claude Code refuse --dangerously-skip-permissions as root?

The permission modes page gives one rule. "On Linux and macOS, Claude Code refuses to start in bypassPermissions mode when running as root or under sudo." The error above is the line it prints.

The check is about the mode, not the spelling. --permission-mode bypassPermissions is the same mode as the flag. My reading of the reason is short. Bypass removes the human from almost every tool call. Root removes the operating system's limits on what those calls can touch. The page names one exception: "The check is skipped automatically inside a recognized sandbox."

I have not hit this error myself. My Claude Code runs as a regular user, not root. Everything below comes from the docs and from GitHub issues, read on 17 October 2026.

How do I fix the root/sudo error?

Run Claude Code as a user that is not root. That is the whole fix. On a server, create a user and switch to it before you start claude. No sudo in front of it.

Docker works the same way. The last USER line in the Dockerfile should not be root. The reference dev container in the anthropics/claude-code repository does this. Its Dockerfile starts from node:20 and ends with USER node. Its devcontainer.json sets the same user:

{
  "remoteUser": "node"
}

The dev container page says the CLI "rejects this flag when launched as root, so confirm remoteUser is set to a non-root account". The same page has a warning worth reading twice. Under the flag, a dev container does not stop a malicious project from exfiltrating anything inside it. That includes the Claude Code credentials in ~/.claude.

If what you want is fewer prompts, not root, the docs point to auto mode. It keeps a classifier in front of risky actions.

Does IS_SANDBOX=1 bypass the root check?

People in GitHub issues say it does. The docs do not mention it. In issue #3490, from July 2025, a user wrote that export IS_SANDBOX=1 "works, although it's not documented". The same tip repeats in #9184, with one report that it still prompted. A May 2026 report, #58150, quotes the check from version 2.1.139. It skips the exit when IS_SANDBOX or CLAUDE_CODE_BUBBLEWRAP equals "1".

That is a user's reading of minified code. I searched the permission modes, dev container, settings and environment variable pages for both names. Zero hits. I have not tested it.

My view is simple. Setting IS_SANDBOX=1 on a real host tells the check something false. Inside a throwaway container that is at least honest. On a laptop full of keys it is a lie. Make a user there.

What is skipDangerousModePermissionPrompt?

It is a setting that skips the warning dialog before bypass mode. The first interactive start in bypass shows that dialog. If you accept, Claude Code writes this to ~/.claude/settings.json:

{
  "skipDangerousModePermissionPrompt": true
}

The settings reference covers the rest. false works like unset. To see the dialog again, delete the key or set it to false. The modes page adds the other branch. If you decline the dialog, Claude Code exits.

The key does not start bypass mode. It only removes the question. You still need the flag, --permission-mode bypassPermissions, or defaultMode in user or managed settings.

Can I put skipDangerousModePermissionPrompt in project settings?

No. Its scope is user, local or managed settings. The reference says "An untrusted repository can't skip the dialog for you." So .claude/settings.json in a repository does not count. .claude/settings.local.json does.

There is one catch with the local file. A background session started with claude --bg reads the acceptance from user or managed settings only. With the key set only in .claude/settings.local.json, the session ignores the bypass request. It pins this notice:

Bypass permissions was requested at launch and ignored · if that was you, ~/.claude/settings.json needs "skipDangerousModePermissionPrompt": true

The fix is in the notice. Add the key to ~/.claude/settings.json and start a new background session. Version 2.1.293 fixed a related bug in claude agents, per the changelog.

Frequently asked questions

Does the root/sudo error happen on Windows?

The docs name Linux and macOS only. The modes page says Claude Code refuses bypass "on Linux and macOS" when running as root or under sudo.

How do I run Claude Code as root in Docker with --dangerously-skip-permissions?

You don't. Give the image a regular user. The reference container ends with USER node. The docs say the root check is skipped in a recognized sandbox. They do not list which ones count.

Does skipDangerousModePermissionPrompt enable bypass mode?

No. It only skips the confirmation dialog. Bypass still needs --dangerously-skip-permissions, --permission-mode bypassPermissions or defaultMode in user or managed settings.

How do I get the bypass permissions dialog back?

Remove skipDangerousModePermissionPrompt from ~/.claude/settings.json, or set it to false. Check your local and managed settings too. Any of them can set it to true.

Other agents handle the no-prompt switch differently. Codex is in Codex dangerously skip permissions, opencode in opencode --dangerously-skip-permissions.

Sources, read on 17 October 2026: Claude Code permission modes, settings reference, dev containers, the changelog, the reference .devcontainer files and issues #3490, #9184 and #58150.