gemini-cli PR fixes rootless podman sandbox EACCES with --userns=keep-id
VishvakR · ghdev · 2026-09-16
PR #29354 in google-gemini/gemini-cli fixes a rootless podman sandbox bug: rootless podman maps container UIDs into the host's subuid range, so files written to the bind-mounted workdir (e.g., node-gyp build dirs) become unmodifiable, surfacing as EACCES failures on native dependency rebuilds. The fix appends --userns=keep-id to podman run when sandbox host-UID mapping is active and podman is rootless. Rootless detection now reads host.security.rootless from podman info instead of checking if the caller is root, preserving behavior for sudo podman and rootful sockets. Explicit --userns in SANDBOXFLAGS wins, and Docker/runsc are untouched. Arch is affected out of the box. Validate with GEMINISANDBOX=podman npm start on a rootless podman host.
More from coding & agent
- Diorama gives OpenAI Codex coding agents a visual office you can watch work in real time — davidfromkansas · 2026-09-17
- Code-first, UI on top: building bespoke brand design tools with AI — floguo · 2026-09-17
- Study of 7 models across Claude Code, Codex, Pi: harness barely affects success but swings cost — DavideCrapis · 2026-09-17
- AI trading bot built with Jev is down 85%, owner shrugs it off — generativist · 2026-09-17
- Redditor's 3-Day SoL-Pi Test: Memory Objects Save ~12k Tokens Per Tool Run — Garblyx · 2026-09-17
- Reviewing AI code through Steve Jobs' lens: unseen internals deserve beauty too — sergeykarayev · 2026-09-17