Original URL: https://getagenttools.com/blog/dangerously-skip-permissions-root-sudo/ # --dangerously-skip-permissions cannot be used with root/sudo privileges: the fix 25 Oct 2026Marek. - claude-code - agent-security - agent-ops Claude Code prints `--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons` when you start bypass mode as root or under `sudo` on Linux or macOS. The fix is to run Claude Code as a normal user. The documented dev container does that. Per the docs, the check is skipped inside a recognized sandbox. ```bash # The error, on Linux or macOS --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons # Check who you are. 0 means root. id -u # Start as a regular user instead of root claude --dangerously-skip-permissions ``` - **Where it fires.** Linux and macOS, as root or under `sudo`, in `bypassPermissions` mode. - **The fix.** A non-root user. In a container, a non-root `USER` or `remoteUser`. - **The workaround people share.** `IS_SANDBOX=1`. It is in GitHub issues, not in the docs. - **The other string.** `skipDangerousModePermissionPrompt` only records that you accepted the warning dialog. It does not turn bypass on. - **Where it can live.** User, local or managed settings. Not the shared project file. The full picture of the flag, and what still stops Claude under it, is in my [--dangerously-skip-permissions](https://getagenttools.com/blog/dangerously-skip-permissions/) post. ## Why does Claude Code refuse --dangerously-skip-permissions as root? The [permission modes page](https://code.claude.com/docs/en/permission-modes#skip-all-checks-with-bypasspermissions-mode) gives one rule. "On Linux and macOS, Claude Code refuses to start in `bypassPermissions` mode when running as root or under `sudo`." The error above is the line it prints. The check is about the mode, not the spelling. `--permission-mode bypassPermissions` is the same mode as the flag. My reading of the reason is short. Bypass removes the human from almost every tool call. Root removes the operating system's limits on what those calls can touch. The page names one exception: "The check is skipped automatically inside a recognized sandbox." I have not hit this error myself. My Claude Code runs as a regular user, not root. Everything below comes from the docs and from GitHub issues, read on 17 October 2026. ## How do I fix the root/sudo error? Run Claude Code as a user that is not root. That is the whole fix. On a server, create a user and switch to it before you start `claude`. No `sudo` in front of it. Docker works the same way. The last `USER` line in the Dockerfile should not be root. The reference dev container in the [anthropics/claude-code](https://github.com/anthropics/claude-code/tree/main/.devcontainer) repository does this. Its Dockerfile starts from `node:20` and ends with `USER node`. Its `devcontainer.json` sets the same user: ```json { "remoteUser": "node" } ``` The [dev container page](https://code.claude.com/docs/en/devcontainer) says the CLI "rejects this flag when launched as root, so confirm `remoteUser` is set to a non-root account". The same page has a warning worth reading twice. Under the flag, a dev container does not stop a malicious project from exfiltrating anything inside it. That includes the Claude Code credentials in `~/.claude`. If what you want is fewer prompts, not root, the docs point to auto mode. It keeps a classifier in front of risky actions. ## Does IS\_SANDBOX=1 bypass the root check? People in GitHub issues say it does. The docs do not mention it. In [issue \#3490](https://github.com/anthropics/claude-code/issues/3490), from July 2025, a user wrote that `export IS_SANDBOX=1` "works, although it's not documented". The same tip repeats in [\#9184](https://github.com/anthropics/claude-code/issues/9184), with one report that it still prompted. A May 2026 report, [\#58150](https://github.com/anthropics/claude-code/issues/58150), quotes the check from version 2.1.139. It skips the exit when `IS_SANDBOX` or `CLAUDE_CODE_BUBBLEWRAP` equals `"1"`. That is a user's reading of minified code. I searched the permission modes, dev container, settings and environment variable pages for both names. Zero hits. I have not tested it. My view is simple. Setting `IS_SANDBOX=1` on a real host tells the check something false. Inside a throwaway container that is at least honest. On a laptop full of keys it is a lie. Make a user there. ## What is skipDangerousModePermissionPrompt? It is a setting that skips the warning dialog before bypass mode. The first interactive start in bypass shows that dialog. If you accept, Claude Code writes this to `~/.claude/settings.json`: ```json { "skipDangerousModePermissionPrompt": true } ``` The [settings reference](https://code.claude.com/docs/en/settings-reference#skipdangerousmodepermissionprompt) covers the rest. `false` works like unset. To see the dialog again, delete the key or set it to `false`. The modes page adds the other branch. If you decline the dialog, Claude Code exits. The key does not start bypass mode. It only removes the question. You still need the flag, `--permission-mode bypassPermissions`, or `defaultMode` in user or managed settings. ### Can I put skipDangerousModePermissionPrompt in project settings? No. Its scope is user, local or managed settings. The reference says "An untrusted repository can't skip the dialog for you." So `.claude/settings.json` in a repository does not count. `.claude/settings.local.json` does. There is one catch with the local file. A background session started with `claude --bg` reads the acceptance from user or managed settings only. With the key set only in `.claude/settings.local.json`, the session ignores the bypass request. It pins this notice: ```text Bypass permissions was requested at launch and ignored ยท if that was you, ~/.claude/settings.json needs "skipDangerousModePermissionPrompt": true ``` The fix is in the notice. Add the key to `~/.claude/settings.json` and start a new background session. Version 2.1.293 fixed a related bug in `claude agents`, per the changelog. ## Frequently asked questions ### Does the root/sudo error happen on Windows? The docs name Linux and macOS only. The modes page says Claude Code refuses bypass "on Linux and macOS" when running as root or under `sudo`. ### How do I run Claude Code as root in Docker with --dangerously-skip-permissions? You don't. Give the image a regular user. The reference container ends with `USER node`. The docs say the root check is skipped in a recognized sandbox. They do not list which ones count. ### Does skipDangerousModePermissionPrompt enable bypass mode? No. It only skips the confirmation dialog. Bypass still needs `--dangerously-skip-permissions`, `--permission-mode bypassPermissions` or `defaultMode` in user or managed settings. ### How do I get the bypass permissions dialog back? Remove `skipDangerousModePermissionPrompt` from `~/.claude/settings.json`, or set it to `false`. Check your local and managed settings too. Any of them can set it to `true`. Other agents handle the no-prompt switch differently. Codex is in [Codex dangerously skip permissions](https://getagenttools.com/blog/codex-dangerously-skip-permissions/), opencode in [opencode --dangerously-skip-permissions](https://getagenttools.com/blog/opencode-dangerously-skip-permissions/). Sources, read on 17 October 2026: Claude Code [permission modes](https://code.claude.com/docs/en/permission-modes), [settings reference](https://code.claude.com/docs/en/settings-reference), [dev containers](https://code.claude.com/docs/en/devcontainer), the [changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md), the reference `.devcontainer` files and issues \#3490, \#9184 and \#58150. Put this into practice [See the tool list](https://getagenttools.com/tools/)[Train your team](https://getagenttools.com/#training)