Gemini CLI PR hardens sandbox: blocks host credentials, mounts sanitized read-only config
diegogodinezr · ghdev · 2026-09-05
A community PR (#29214) against google-gemini/gemini-cli hardens sandbox isolation across Docker, Podman, runsc, LXC and macOS Seatbelt:
- Mount isolation: isSensitiveHostPath() blocks mounting /.gemini, home directory roots, .env files and credential stores into containers, raising FatalSandboxError on violations.
- Settings sanitization: sanitizeSettingsForSandbox() strips hooks, custom tool commands and API keys, mounting only a sanitized read-only settings. inside the container.
- Runtime redirection: new Storage.isSandbox() / getGlobalRuntimeDir() APIs route chat logs, session history and scratch files to an ephemeral tmpdir instead of host config folders.
A useful reference for anyone building sandboxed agent runtimes.
More from coding & agent
- Dimillian builds a game from scratch in an hour with Astra Ultra, using just 5% of his weekly quota — Dimillian · 2026-09-05
- Full walkthrough: how Nissim Lebovits used AI agents to find 3 million missing people — MaxLenormand · 2026-09-05
- Cortex: an MIT-licensed local SQLite memory layer for coding agents, open-sourced for feedback — Royal_Philosopher_58 · 2026-09-05
- Dev builds unified directory indexing AI agents, MCP servers and skills — exposed as an MCP server itself — No_Cake8366 · 2026-09-05
- Bug Hunt Bench: 105 real bugs stress-test GPT-6, Claude, Grok, Gemini and more coding agents — PawelHuryn · 2026-09-05
- Hermes Agent adds Perplexity as selectable web search and scraping backend — Teknium · 2026-09-05