Gemini CLI PR fixes rootless Podman sandbox EACCES by adding --userns=keep-id
AbbasFullstack · ghdev · 2026-10-12
A PR to google-gemini/gemini-cli fixes an EACCES error hit by rootless Podman users: the container's user namespace didn't map the caller's UID, so sandboxed commands running as a non-root user failed.
Key points:
- The fix appends --userns=keep-id to sandbox args only when the command is podman, rootless mode is detected via podman info, the relevant code path is active, and SANDBOXFLAGS doesn't already set --userns
- Docker and rootful Podman setups are unchanged; user-provided --userns values are never overridden
- Includes unit tests for three new helpers and validation steps
A small but directly useful fix for developers running Gemini CLI sandboxes with rootless Podman on Linux.
More from coding & agent
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23