gemini-cli PR fixes rootless podman sandbox EACCES with --userns=keep-id
VishvakR · ghdev · 2026-09-16
PR #29354 in google-gemini/gemini-cli fixes a rootless podman sandbox bug: rootless podman maps container UIDs into the host's subuid range, so files written to the bind-mounted workdir (e.g., node-gyp build dirs) become unmodifiable, surfacing as EACCES failures on native dependency rebuilds. The fix appends --userns=keep-id to podman run when sandbox host-UID mapping is active and podman is rootless. Rootless detection now reads host.security.rootless from podman info instead of checking if the caller is root, preserving behavior for sudo podman and rootful sockets. Explicit --userns in SANDBOXFLAGS wins, and Docker/runsc are untouched. Arch is affected out of the box. Validate with GEMINISANDBOX=podman npm start on a rootless podman host.
More from coding & agent
- Microsoft's MemSteer turns unlabeled user histories into agent memory supervision — MicrosoftResearch · 2026-11-02
- She fired herself from her own Instagram: AI agent runs the account, views up 82.3% — heyshrutimishra · 2026-11-02
- Sourcegraph: AI writes code faster than teams can review it, driving more outages — AI Engineer · 2026-11-02
- Tsinghua & Microsoft's HarnessMM cuts agent token use by up to 87.93% while raising success rate — rohanpaul_ai · 2026-11-02
- GitHub launches Agent HQ: Anthropic, OpenAI, Google coding agents in Copilot — emmanuelvivier · 2026-11-02
- DeepSeek open-sources Super-Agent, a coding agent that reads team chats to minimize human input — emmanuelvivier · 2026-11-02