Gemini CLI fix: Isolate Docker runtime in macOS Seatbelt sandbox
josebalius · ghdev · 2026-08-21
- Vulnerability: Previously, the sandbox allowed communication with container daemons on macOS, potentially mounting the host filesystem via VirtioFS to escape the Seatbelt boundary.
- Fix: Explicitly denies access within macOS Seatbelt profiles to:
- Unix Domain Sockets: e.g., /var/run/docker.sock and user runtime paths.
- Container CLI/Daemon Binaries: e.g., docker, podman, colima.
- Mach/XPC Service Lookups and POSIX shared memory.
- Verification: Includes unit tests verifying profile generation and invariants.
More from coding & agent
- Decision models match LLMs on routing and safety — and are 7-8x faster — randal_olson · 2026-10-16
- Temporal Serverless Workers on Cloud Run: queue-driven autoscaling, scale to zero — rseroter · 2026-10-16
- Meta's Superintelligence Lab Runs 200+ Direct Reports—A Lesson for Flat Multi-Agent Systems — peterjliu · 2026-10-16
- LangChain CEO: the most interesting agent harness work lives at the harness-infra boundary — hwchase17 · 2026-10-16
- GitSwarm paper: agents share branchable Git memory, solving all 30 IMOProofBench problems in one run — anirudhg9119 · 2026-10-16
- Hands-on with Gemini 4 Argon: faster than Opus 5.5 but hallucinates more and costs more — prasenx · 2026-10-16