# Gemini CLI v0.68 fixes rootless Podman sandboxing and path boundary checks > Source: > Published: 2026-11-15 19:16:07+00:00 *Originally published at [https://aicoding-guide.com](https://aicoding-guide.com/en/posts/gemini-cli-update-0-68/).* Gemini CLI v0.68.0 ships **with no summary prose at all** — the release page is just a list of pull requests. One feature; everything else is a fix. It looks unremarkable, but **three of the fixes are about boundaries**, and each one is a case where behaviour the docs already describe was not holding in some environment. **Key point** What you will learn - When `--userns=keep-id` is passed for rootless Podman, and how to override it- The fixes to root checks on Windows and to symlink resolution in GlobTool - That the new extension validation command and the hooks' `SubagentStop` are both absent from the docs The fix is `fix(sandbox): supply --userns=keep-id for rootless podman` (#30118). This behaviour is documented, under "Linux UID/GID handling": Gemini CLI automatically handles user permissions in container sandboxes on Linux. When the sandbox runs as your host UID/GID (the default on supported Linux distributions) and you use rootless Podman, Gemini CLI also passes `--userns=keep-id`. This keeps files that the sandbox creates in mounted directories owned by your host user. To use a different user namespace mode, add your own `--userns` option to `SANDBOX_FLAGS`. The promise is that files the sandbox writes into mounted directories stay owned by your host user. If ownership was turning into root under rootless Podman, that promise was not being kept until this release. There are three ways to select the backend, in a fixed order of precedence. | Method | How | |---|---| | Command flag | `-s` or`--sandbox` | | Environment variable | `GEMINI_SANDBOX=true\ | | Settings file | {% raw %} `"sandbox": true` inside the`tools` object of`settings.json` | ``` # Turn on sandboxing with rootless Podman export GEMINI_SANDBOX=podman gemini # Pick a different user namespace mode yourself export SANDBOX_FLAGS="--userns=host" ``` `SANDBOX_SET_UID_GID` switches the mapping itself: `true` forces the host UID/GID, `false` disables UID/GID mapping. The other two concern which paths count as inside your working area. `fix(core): make isWithinRoot case-insensitive on Windows` (#29999) — root checks on Windows no longer depend on case, which matters if `C:\Project` and `c:\project` were being treated as different places`fix(core): resolve symlinked paths canonically in GlobTool` (#30042) — GlobTool now resolves symlinked paths canonically **Neither behaviour is stated in the documentation** The workspace concept itself is documented. The sandbox page says "the sandbox only has access to the current project workspace" and points you at `SANDBOX_MOUNTS` when something outside it must be reachable. But **whether path comparison is case-sensitive on Windows, and how the file tools resolve symlinks, could not be confirmed in the official documentation.** The PR titles tell you what changed; no specification-level statement exists. If you need the outside of the workspace genuinely blocked, turn the sandbox on and pass what you need explicitly with `SANDBOX_MOUNTS`. There is also a fix about git's exclude files: `fix(core): honor .git/info/exclude and core.excludesFile in shadow repo` (#30034). Here too, **no documented statement that `.git/info/exclude` or `core.excludesFile` are honored could be found.** These are the exclude settings that are documented: | Setting | What it does | |---|---| | `context.fileFiltering.respectGitIgnore` | Respect `.gitignore` (default`true` ) | | `context.fileFiltering.respectGeminiIgnore` | Respect `.geminiignore` (default`true` ) | | `context.fileFiltering.customIgnoreFilePaths` | Additional ignore file paths, which take precedence over `.geminiignore` and`.gitignore` | If you want an extra ignore file to count on, naming it in `customIgnoreFilePaths` is the documented route. The release's only feature is `feat(cli): add extension validation command and evaluation tests` (#29980). **But as of 2026-11-16 no `validate` subcommand appears in the official documentation.** The documented `gemini extensions` subcommands are: ``` install / uninstall / disable / enable / update / new / link / list / config ``` The slash-command form, `/extensions`, lists ten: `config`, `disable`, `enable`, `explore`, `install`, `link`, `list`, `restart`, `uninstall`, `update`. No `validate`. There is a hooks fix too: `fix(hooks): support SubagentStop event mapping and merge hook definitions` (#30111). Read that one carefully. **`SubagentStop` does not appear in the documented list of hook events.** The documented events are these eleven: ``` SessionStart / SessionEnd / BeforeAgent / AfterAgent / BeforeModel / AfterModel BeforeToolSelection / BeforeTool / AfterTool / PreCompress / Notification ``` `SubagentStop` is a Claude Code event name. Gemini CLI does carry a compatibility environment variable, `CLAUDE_PROJECT_DIR`, so this could plausibly be about mapping a migrated Claude Code configuration — but **no official statement to that effect could be found.** For the hooks' `timeout` being in milliseconds (default 60000), see [Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration](https://aicoding-guide.com/en/posts/gemini-cli-update-0-67/). Three concern model selection. `fix(core,cli): preserve selected model across transient fallback, cancel, and rewind` (#30059) — your chosen model survives a transient fallback, a cancel, and a rewind`fix(core): preserve explicit gemini-2.5-flash model in dynamic model resolution` (#30057) — an explicitly chosen `gemini-2.5-flash` is not replaced by dynamic resolution`fix(core): list Auto in /model when dynamicModelConfiguration is enabled and preview access is disabled` (#29998) The one you are most likely to notice day to day is `fix(cli): surface 429 rate limit cool-down and countdown in loading indicator` (#30012): when you hit a rate limit, the cool-down and a countdown now appear in the loading indicator. For the free-tier ceilings, see [Gemini CLI free tier limits and how paid plans differ](https://aicoding-guide.com/en/posts/gemini-cli-free-tier-limits/). On extensions, concurrent installs are now serialized with a per-extension lock (#30039), and stream failures during extension release downloads are handled (#30100). For MCP server configuration, see [Add an MCP server to Gemini CLI](https://aicoding-guide.com/en/posts/gemini-cli-mcp/). `--userns=keep-id`, which is documented behaviour; to use another mode, add `--userns` to `SANDBOX_FLAGS` yourself`SubagentStop` are both missing from the official documentation