Agent Sandboxesagentsandboxes.org
Sandbox profile · Local / OS-level

Gemini CLI sandboxing

Answer in brief

Gemini CLI's built-in sandbox: macOS Seatbelt profiles or a Docker/Podman container around the agent's tool calls, with gVisor, LXC and a Windows option. Adequate built-in confinement for Gemini CLI users; it is a feature of the CLI rather than a general sandbox.

By the Agent Sandboxes editors · Updated

Overview

Gemini CLI ships sandboxing for the commands and tools the agent runs. It is enabled with -s/--sandbox, GEMINI_SANDBOX or "sandbox": true in settings. On macOS the lightweight option is the built-in Seatbelt framework via sandbox-exec, with SEATBELT_PROFILE selecting among permissive/restrictive/strict profiles in open or proxied network variants; the default permissive-open "denies operations by default" and limits writes to the project directory. Elsewhere it runs the agent in a Docker or Podman container from ghcr.io/google/gemini-cli:latest, replaceable with a project .gemini/sandbox.Dockerfile. gVisor, LXC/LXD (experimental) and a Windows native sandbox are also listed.

Tool-level sandboxing is on by default (security.toolSandboxing). The docs note GUI applications may not work in sandboxes and that gVisor cannot reach host loopback services. The CLI is Apache-2.0; its README states it is now aimed at Gemini Code Assist Standard/Enterprise licences and that free individual access moved to Antigravity CLI on 18 June 2026.

Notable

  • Six Seatbelt profiles on macOS; default permissive-open; container image ghcr.io/google/gemini-cli:latest
  • README: free individual and Google AI Pro/Ultra access moved to Antigravity CLI on 18 June 2026; Gemini CLI targets Code Assist Standard/Enterprise
  • Release channels: Preview (weekly), Stable (weekly), Nightly (daily)

Gemini CLI sandboxing specifications

AttributeDetails
IsolationmacOS Seatbelt (sandbox-exec) with six profiles from permissive-open (default) to strict-proxied; Docker or Podman container on any platform; gVisor (runsc), LXC/LXD (experimental) and a Windows native sandbox each on their own OS
DeploymentLocal / OS-level
Open sourceYes (Apache-2.0)
SDKs and interfacesCLI
Cold start (vendor claim)Not documented
Max session lengthNot documented
PersistenceWorks on the project directory on the host; the default Seatbelt profile limits writes to the project directory
GPUNot documented
Networking-open Seatbelt profiles allow direct network access, -proxied profiles route through a proxy; container sandboxes can be run with --network=none, which also blocks the Gemini API
PricingFree, open-source CLI; the README says it is designed for Gemini Code Assist Standard/Enterprise licences with no free tier
Free tierNot documented
ComplianceNot documented
RegionsNot documented

Facts from Gemini CLI sandboxing’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You use Gemini CLI and want built-in confinement with no extra tooling on macOS
  • You want a container-based sandbox with a custom Dockerfile on Linux
  • You need a proxied network profile for the agent

Trade-offs

  • Seatbelt shares the host kernel; container isolation depends on Docker/Podman
  • LXC is experimental and must be pre-created; gVisor must be selected explicitly
  • The CLI is now positioned for enterprise Code Assist licences

Good fit for: Confining Gemini CLI tool execution on a developer machine using built-in OS or container sandboxing.

Use cases Gemini CLI sandboxing fits

  • Local agents: Gemini CLI’s built-in sandboxing via macOS Seatbelt or Docker and Podman containers.

How Gemini CLI sandboxing compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
Gemini CLI sandboxingSeatbelt or containerYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Codex CLI sandboxingSeatbelt / bubblewrap / WindowsYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Anthropic Sandbox RuntimeOS-level (Seatbelt / bubblewrap)YesYes / Not documentedProcess startNot documentedNo / NoNot documentedCLI (srt), TypeScript (npm)
nonoLandlock / SeatbeltYesNo / NoNot documentedNot documentedYes / Not documentedNot documentedCLI, Rust, Python, JavaScript/TypeScript, Go
Docker SandboxesMicroVMNoYes / NoNot documentedUntil removed (local)Yes / YesYessbx CLI, TypeScript (cloud), REST API (cloud)
Minimalnamespaces or libkrun microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI, MCP server
gVisorUser-space kernelYesYes / Noms (claim)Not documentedYes / Not documentedYesCLI

See all Gemini CLI sandboxing alternatives →

Frequently asked questions

What is Gemini CLI sandboxing?
Gemini CLI's built-in sandbox: macOS Seatbelt profiles or a Docker/Podman container around the agent's tool calls, with gVisor, LXC and a Windows option. Adequate built-in confinement for Gemini CLI users; it is a feature of the CLI rather than a general sandbox.
How does Gemini CLI sandboxing isolate code?
Gemini CLI sandboxing documents its isolation as: macOS Seatbelt (sandbox-exec) with six profiles from permissive-open (default) to strict-proxied; Docker or Podman container on any platform; gVisor (runsc), LXC/LXD (experimental) and a Windows native sandbox each on their own OS.
Is Gemini CLI sandboxing open source?
Yes (Apache-2.0).
How much does Gemini CLI sandboxing cost?
Free, open-source CLI; the README says it is designed for Gemini Code Assist Standard/Enterprise licences with no free tier Check the official pricing page for current rates.
What are the alternatives to Gemini CLI sandboxing?

Sources

  1. github.com/google-gemini/gemini-cli/blob/main/docs/cli/sandbox.md
  2. github.com/google-gemini/gemini-cli

Cite this page

Agent Sandboxes. (2026). Gemini CLI sandboxing. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/gemini-cli-sandbox/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.