Gemini CLI hardens sandbox: read-only config mounts, tmpfs runtime state, and secrets stripping
diegogodinezr · ghdev · 2026-09-11
A PR in google-gemini/gemini-cli (#29283) strengthens filesystem isolation for --sandbox runs under Docker, Podman, runsc, LXC, and macOS Seatbelt.
- Isolated settings directories are mounted read-only; /tmp and /history use tmpfs so session history and project registry data never persist to the host. Host home and os.tmpdir() mounts were removed.
- SANDBOXMOUNTS validation now rejects read-write mounts of the config directory with a FatalSandboxError, and allowedPaths filtering keeps config paths out of Docker/LXC runners.
- Sensitive settings (trusted hooks/folders, policy integrity, .env variants, SSH private keys, API keys, hooks, security.auth) are stripped from configs before they are copied into sandboxes.
More from coding & agent
- Researcher predicted multi-agent hidden coordination failure mode a year ago — it's now real — tianshi_li · 2026-09-12
- Dev uses AI to build a macOS widget for Fahrenheit-Celsius conversion, iterating past the 'AI slop' stage — floguo · 2026-09-12
- NoSpoon agent autonomously cranks out hilarious AI microdramas, 40-min episodes coming — Kyrannio · 2026-09-12
- Minecraft survival bot masters walking but keeps dying to night drifters; burrow goal next — zeeg · 2026-09-12
- LinkedIn user claims GPT-6 built a pixel-perfect Figma design system in 3 hours — AIandDesign · 2026-09-12
- OpenAI to co-host 'Agents, Everywhere' one-day hackathon across 50 cities on Sep 12 — seanmcdonaldxyz · 2026-09-12