abi <abi/4.0>,
include <tunables/global>

# flags=(unconfined) does not confine the app; it only allowlists it for
# CLONE_NEWUSER so Chromium's namespace sandbox works where unprivileged
# userns is restricted. Same pattern as Chrome / VS Code / 1Password.
profile claude-desktop /usr/lib/claude-desktop/claude-desktop flags=(unconfined) {
  userns,

  include if exists <local/claude-desktop>
}
