Gemini CLI hardens sandbox: read-only config mounts, tmpfs runtime state, and secrets stripping
diegogodinezr · ghdev · 2026-09-11
A PR in google-gemini/gemini-cli (#29283) strengthens filesystem isolation for --sandbox runs under Docker, Podman, runsc, LXC, and macOS Seatbelt.
- Isolated settings directories are mounted read-only; /tmp and /history use tmpfs so session history and project registry data never persist to the host. Host home and os.tmpdir() mounts were removed.
- SANDBOXMOUNTS validation now rejects read-write mounts of the config directory with a FatalSandboxError, and allowedPaths filtering keeps config paths out of Docker/LXC runners.
- Sensitive settings (trusted hooks/folders, policy integrity, .env variants, SSH private keys, API keys, hooks, security.auth) are stripped from configs before they are copied into sandboxes.
More from coding & agent
- One-person companies are about the org chart, not headcount: humans judge, agents execute — ciguleva · 2026-10-28
- OATs: open-source toolkit turns everyday objects into personality-bearing agents — Stefania_druga · 2026-10-28
- Dev: local coding dropped from 100% to 5% in a year as cloud agents take over — bytebot · 2026-10-28
- Open-sourced 501(c)(FREE): agent-built free back office for US nonprofits — gralston · 2026-10-28
- Grok Bot 1.0.0 early build reveals Shared Bots, service accounts and team workflows — XFreeze · 2026-10-28
- Anne Griffin hosts 20-person SF salon on the product decisions behind AI agents — annetgriffin · 2026-10-28