Gemini CLI PR hardens sandbox: blocks host credentials, mounts sanitized read-only config
diegogodinezr · ghdev · 2026-09-05
A community PR (#29214) against google-gemini/gemini-cli hardens sandbox isolation across Docker, Podman, runsc, LXC and macOS Seatbelt:
- Mount isolation: isSensitiveHostPath() blocks mounting /.gemini, home directory roots, .env files and credential stores into containers, raising FatalSandboxError on violations.
- Settings sanitization: sanitizeSettingsForSandbox() strips hooks, custom tool commands and API keys, mounting only a sanitized read-only settings. inside the container.
- Runtime redirection: new Storage.isSandbox() / getGlobalRuntimeDir() APIs route chat logs, session history and scratch files to an ephemeral tmpdir instead of host config folders.
A useful reference for anyone building sandboxed agent runtimes.
More from coding & agent
- PostgreSQL 19 slips to November as LLM-assisted code review floods committers with edge cases — sanjaykalra · 2026-10-21
- LangChain adds Human-in-the-Loop beta to Managed Deep Agents — LangChain · 2026-10-21
- Voxtral 3 ships a LiveKit-based voice agent SDK streaming listen-think-speak — MistralAI · 2026-10-21
- Open-sourced pixel art normals generator ships as Rust CLI and wasm library — HugoDuprez · 2026-10-20
- Eval researcher teases guide to subjective-task evals, with a curated resource list — cwolferesearch · 2026-10-20
- Eon cuts engineer onboarding from 2 days to 2 minutes with an MCP Gateway on Bedrock AgentCore — AWS ML Blog · 2026-10-20