Gemini CLI PR isolates settings dir in sandbox containers to stop OAuth credential leaks
jvargassanchez-dot · ghdev · 2026-09-05
A gemini-cli PR addresses a security gap: when running inside Docker/Podman sandboxes, the host's /.gemini directory was mounted directly into the container, potentially exposing OAuth tokens, account credentials, and auth stores.
Key changes:
- New prepareIsolatedSettingsDir and isCredentialOrSensitivePath helpers redact known credential files (oauthcreds., googleaccounts., MCP/A2A OAuth token stores) plus history/tmp/bin caches;
- Only non-sensitive config (settings., commands, skills, policies, keybindings, trusted folders) is copied to a session-scoped temp directory;
- The isolated dir is mounted at /home/node/.gemini instead of the raw host directory, while functional mounts (workdir, gcloud config, Vertex AI ADC credentials) are preserved;
- Automatic cleanup on process exit and signals.
More from coding & agent
- Cognition rumored to launch a new model soon, per AI insider hunch — realsohamparekh · 2026-09-06
- Redditor builds free AskSary creative studio with game engine GPT can play and patch live — Beneficial-Cow-7408 · 2026-09-06
- Do the fun terminal work yourself, let Claude handle the boring chores — 4310sy · 2026-09-06
- Heavy AI user's cost ledger: 100+ agents a day, $70 of DeepSeek in two days — simmon_charlie · 2026-09-06
- First untrained agent run on local Qwen 3.8 Flash, no skills configured — jasonkneen · 2026-09-06
- Is a schema-aware memory graph 'overfitting'? Dev asks for the cleanest leakage test — chaachans · 2026-09-06