Gemini CLI v0.68 fixes rootless Podman sandboxing and path boundary checks

Originally published at https://aicoding-guide.com.

Gemini CLI v0.68.0 ships with no summary prose at all — the release page is just a list of pull requests. One feature; everything else is a fix.

It looks unremarkable, but three of the fixes are about boundaries, and each one is a case where behaviour the docs already describe was not holding in some environment.

Key point

What you will learn

• When --userns=keep-id is passed for rootless Podman, and how to override it- The fixes to root checks on Windows and to symlink resolution in GlobTool
• That the new extension validation command and the hooks' SubagentStop are both absent from the docs

The fix is fix(sandbox): supply --userns=keep-id for rootless podman (#30118). This behaviour is documented, under "Linux UID/GID handling":

Gemini CLI automatically handles user permissions in container sandboxes on Linux. When the sandbox runs as your host UID/GID (the default on supported Linux distributions) and you use rootless Podman, Gemini CLI also passes --userns=keep-id. This keeps files that the sandbox creates in mounted directories owned by your host user. To use a different user namespace mode, add your own --userns option to SANDBOX_FLAGS.

The promise is that files the sandbox writes into mounted directories stay owned by your host user. If ownership was turning into root under rootless Podman, that promise was not being kept until this release.

There are three ways to select the backend, in a fixed order of precedence.

export GEMINI_SANDBOX=podman
gemini

export SANDBOX_FLAGS="--userns=host"

SANDBOX_SET_UID_GID switches the mapping itself: true forces the host UID/GID, false disables UID/GID mapping.

The other two concern which paths count as inside your working area.

fix(core): make isWithinRoot case-insensitive on Windows (#29999) — root checks on Windows no longer depend on case, which matters if C:\Project and c:\project were being treated as different placesfix(core): resolve symlinked paths canonically in GlobTool (#30042) — GlobTool now resolves symlinked paths canonically Neither behaviour is stated in the documentation

The workspace concept itself is documented. The sandbox page says "the sandbox only has access to the current project workspace" and points you at SANDBOX_MOUNTS when something outside it must be reachable.

But whether path comparison is case-sensitive on Windows, and how the file tools resolve symlinks, could not be confirmed in the official documentation. The PR titles tell you what changed; no specification-level statement exists. If you need the outside of the workspace genuinely blocked, turn the sandbox on and pass what you need explicitly with SANDBOX_MOUNTS.

There is also a fix about git's exclude files: fix(core): honor .git/info/exclude and core.excludesFile in shadow repo (#30034). Here too, no documented statement that .git/info/exclude or core.excludesFile are honored could be found. These are the exclude settings that are documented:

If you want an extra ignore file to count on, naming it in customIgnoreFilePaths is the documented route.

The release's only feature is feat(cli): add extension validation command and evaluation tests (#29980). But as of 2026-11-16 no validate subcommand appears in the official documentation. The documented gemini extensions subcommands are:

install / uninstall / disable / enable / update / new / link / list / config

The slash-command form, /extensions, lists ten: config, disable, enable, explore, install, link, list, restart, uninstall, update. No validate.

There is a hooks fix too: fix(hooks): support SubagentStop event mapping and merge hook definitions (#30111). Read that one carefully. SubagentStop does not appear in the documented list of hook events. The documented events are these eleven:

SessionStart / SessionEnd / BeforeAgent / AfterAgent / BeforeModel / AfterModel
BeforeToolSelection / BeforeTool / AfterTool / PreCompress / Notification

SubagentStop is a Claude Code event name. Gemini CLI does carry a compatibility environment variable, CLAUDE_PROJECT_DIR, so this could plausibly be about mapping a migrated Claude Code configuration — but no official statement to that effect could be found. For the hooks' timeout being in milliseconds (default 60000), see Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration.

Three concern model selection.

fix(core,cli): preserve selected model across transient fallback, cancel, and rewind (#30059) — your chosen model survives a transient fallback, a cancel, and a rewindfix(core): preserve explicit gemini-2.5-flash model in dynamic model resolution (#30057) — an explicitly chosen gemini-2.5-flash is not replaced by dynamic resolutionfix(core): list Auto in /model when dynamicModelConfiguration is enabled and preview access is disabled (#29998) The one you are most likely to notice day to day is fix(cli): surface 429 rate limit cool-down and countdown in indicator (#30012): when you hit a rate limit, the cool-down and a countdown now appear in the indicator. For the free-tier ceilings, see Gemini CLI free tier limits and how paid plans differ.

On extensions, concurrent installs are now serialized with a per-extension lock (#30039), and stream failures during extension release downloads are handled (#30100). For MCP server configuration, see Add an MCP server to Gemini CLI.

--userns=keep-id, which is documented behaviour; to use another mode, add --userns to SANDBOX_FLAGS yourselfSubagentStop are both missing from the official documentation