{"slug": "gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks", "title": "Gemini CLI v0.68 fixes rootless Podman sandboxing and path boundary checks", "summary": "Gemini CLI v0.68.0 shipped with a release page consisting only of pull requests, led by a fix that passes --userns=keep-id for rootless Podman so files the sandbox writes into mounted directories stay owned by the host user. The release also makes isWithinRoot case-insensitive on Windows, resolves symlinked paths canonically in GlobTool, and honors .git/info/exclude and core.excludesFile in the shadow repo, none of which are confirmed in the official documentation. Its only feature is an extension validation command with evaluation tests.", "body_md": "*Originally published at [https://aicoding-guide.com](https://aicoding-guide.com/en/posts/gemini-cli-update-0-68/).*\n\nGemini CLI v0.68.0 ships **with no summary prose at all** — the release page is just a list of pull requests. One feature; everything else is a fix.\n\nIt looks unremarkable, but **three of the fixes are about boundaries**, and each one is a case where behaviour the docs already describe was not holding in some environment.\n\n**Key point**\n\nWhat you will learn\n\n- When\n`--userns=keep-id` is passed for rootless Podman, and how to override it- The fixes to root checks on Windows and to symlink resolution in GlobTool\n- That the new extension validation command and the hooks'\n`SubagentStop` are both absent from the docs\n\nThe fix is `fix(sandbox): supply --userns=keep-id for rootless podman` (#30118). This behaviour is documented, under \"Linux UID/GID handling\":\n\nGemini CLI automatically handles user permissions in container sandboxes on Linux. When the sandbox runs as your host UID/GID (the default on supported Linux distributions) and you use rootless Podman, Gemini CLI also passes `--userns=keep-id`. This keeps files that the sandbox creates in mounted directories owned by your host user. To use a different user namespace mode, add your own `--userns` option to `SANDBOX_FLAGS`.\n\nThe promise is that files the sandbox writes into mounted directories stay owned by your host user. If ownership was turning into root under rootless Podman, that promise was not being kept until this release.\n\nThere are three ways to select the backend, in a fixed order of precedence.\n\n| Method | How | \n|---|---|\n| Command flag | `-s` or`--sandbox` | \n| Environment variable | `GEMINI_SANDBOX=true\\ | \n| Settings file | {% raw %} `\"sandbox\": true` inside the`tools` object of`settings.json` | \n\n```\n# Turn on sandboxing with rootless Podman\nexport GEMINI_SANDBOX=podman\ngemini\n\n# Pick a different user namespace mode yourself\nexport SANDBOX_FLAGS=\"--userns=host\"\n```\n\n`SANDBOX_SET_UID_GID` switches the mapping itself: `true` forces the host UID/GID, `false` disables UID/GID mapping.\n\nThe other two concern which paths count as inside your working area.\n\n`fix(core): make isWithinRoot case-insensitive on Windows` (#29999) — root checks on Windows no longer depend on case, which matters if `C:\\Project` and `c:\\project` were being treated as different places`fix(core): resolve symlinked paths canonically in GlobTool` (#30042) — GlobTool now resolves symlinked paths canonically\n**Neither behaviour is stated in the documentation**\n\nThe workspace concept itself is documented. The sandbox page says \"the sandbox only has access to the current project workspace\" and points you at `SANDBOX_MOUNTS` when something outside it must be reachable.\n\nBut **whether path comparison is case-sensitive on Windows, and how the file tools resolve symlinks, could not be confirmed in the official documentation.** The PR titles tell you what changed; no specification-level statement exists. If you need the outside of the workspace genuinely blocked, turn the sandbox on and pass what you need explicitly with `SANDBOX_MOUNTS`.\n\nThere is also a fix about git's exclude files: `fix(core): honor .git/info/exclude and core.excludesFile in shadow repo` (#30034). Here too, **no documented statement that `.git/info/exclude` or `core.excludesFile` are honored could be found.** These are the exclude settings that are documented:\n\n| Setting | What it does | \n|---|---|\n| `context.fileFiltering.respectGitIgnore` | Respect `.gitignore` (default`true` ) | \n| `context.fileFiltering.respectGeminiIgnore` | Respect `.geminiignore` (default`true` ) | \n| `context.fileFiltering.customIgnoreFilePaths` | Additional ignore file paths, which take precedence over `.geminiignore` and`.gitignore` | \n\nIf you want an extra ignore file to count on, naming it in `customIgnoreFilePaths` is the documented route.\n\nThe release's only feature is `feat(cli): add extension validation command and evaluation tests` (#29980). **But as of 2026-11-16 no `validate` subcommand appears in the official documentation.** The documented `gemini extensions` subcommands are:\n\n```\ninstall / uninstall / disable / enable / update / new / link / list / config\n```\n\nThe slash-command form, `/extensions`, lists ten: `config`, `disable`, `enable`, `explore`, `install`, `link`, `list`, `restart`, `uninstall`, `update`. No `validate`.\n\nThere is a hooks fix too: `fix(hooks): support SubagentStop event mapping and merge hook definitions` (#30111). Read that one carefully. **`SubagentStop` does not appear in the documented list of hook events.** The documented events are these eleven:\n\n```\nSessionStart / SessionEnd / BeforeAgent / AfterAgent / BeforeModel / AfterModel\nBeforeToolSelection / BeforeTool / AfterTool / PreCompress / Notification\n```\n\n`SubagentStop` is a Claude Code event name. Gemini CLI does carry a compatibility environment variable, `CLAUDE_PROJECT_DIR`, so this could plausibly be about mapping a migrated Claude Code configuration — but **no official statement to that effect could be found.** For the hooks' `timeout` being in milliseconds (default 60000), see [Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration](https://aicoding-guide.com/en/posts/gemini-cli-update-0-67/).\n\nThree concern model selection.\n\n`fix(core,cli): preserve selected model across transient fallback, cancel, and rewind` (#30059) — your chosen model survives a transient fallback, a cancel, and a rewind`fix(core): preserve explicit gemini-2.5-flash model in dynamic model resolution` (#30057) — an explicitly chosen `gemini-2.5-flash` is not replaced by dynamic resolution`fix(core): list Auto in /model when dynamicModelConfiguration is enabled and preview access is disabled` (#29998)\nThe one you are most likely to notice day to day is `fix(cli): surface 429 rate limit cool-down and countdown in loading indicator` (#30012): when you hit a rate limit, the cool-down and a countdown now appear in the loading indicator. For the free-tier ceilings, see [Gemini CLI free tier limits and how paid plans differ](https://aicoding-guide.com/en/posts/gemini-cli-free-tier-limits/).\n\nOn extensions, concurrent installs are now serialized with a per-extension lock (#30039), and stream failures during extension release downloads are handled (#30100). For MCP server configuration, see [Add an MCP server to Gemini CLI](https://aicoding-guide.com/en/posts/gemini-cli-mcp/).\n\n`--userns=keep-id`, which is documented behaviour; to use another mode, add `--userns` to `SANDBOX_FLAGS` yourself`SubagentStop` are both missing from the official documentation", "url": "https://wpnews.pro/news/gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks", "canonical_source": "https://dev.to/aicoding-guide/gemini-cli-v068-fixes-rootless-podman-sandboxing-and-path-boundary-checks-2520", "published_at": "2026-11-15 19:16:07+00:00", "updated_at": "2026-11-15 19:20:42.624923+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents"], "entities": ["Gemini CLI", "Podman", "GlobTool", "Google"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks", "markdown": "https://wpnews.pro/news/gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks.md", "text": "https://wpnews.pro/news/gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks.txt", "jsonld": "https://wpnews.pro/news/gemini-cli-v0-68-fixes-rootless-podman-sandboxing-and-path-boundary-checks.jsonld"}}