Gemini CLI PR isolates settings dir in sandbox containers to stop OAuth credential leaks
jvargassanchez-dot · ghdev · 2026-09-05
A gemini-cli PR addresses a security gap: when running inside Docker/Podman sandboxes, the host's /.gemini directory was mounted directly into the container, potentially exposing OAuth tokens, account credentials, and auth stores.
Key changes:
- New prepareIsolatedSettingsDir and isCredentialOrSensitivePath helpers redact known credential files (oauthcreds., googleaccounts., MCP/A2A OAuth token stores) plus history/tmp/bin caches;
- Only non-sensitive config (settings., commands, skills, policies, keybindings, trusted folders) is copied to a session-scoped temp directory;
- The isolated dir is mounted at /home/node/.gemini instead of the raw host directory, while functional mounts (workdir, gcloud config, Vertex AI ADC credentials) are preserved;
- Automatic cleanup on process exit and signals.
More from coding & agent
- 105 Real Bugs Tested: GPT-6.1 Sol Over 10x Cheaper Than GPT-5.6 Sol — PawelHuryn · 2026-10-23
- Dev builds SkiFree-style sled game in one prompt, praises DeepSeek Flash — victormustar · 2026-10-23
- Every ditched personal agents for a shared Claude Managed Agents coworker in one week — every · 2026-10-23
- WorkOS shows how to let AI agents safely sign up for your app with auth.md and ID-JAG — AI Engineer · 2026-10-23
- Devs on Reddit swap tactics for stopping prompt regressions in AI agents — SleepFlimsy6963 · 2026-10-23
- Claude Code + ComfyUI MCP workflow for client work: paid models or open weights? — newaccount47 · 2026-10-23