Gemini CLI v0.68 fixes rootless Podman sandboxing and path boundary checks

Gemini CLI v0.68.0 shipped with a release page consisting only of pull requests, led by a fix that passes --userns=keep-id for rootless Podman so files the sandbox writes into mounted directories stay owned by the host user. The release also makes isWithinRoot case-insensitive on Windows, resolves symlinked paths canonically in GlobTool, and honors .git/info/exclude and core.excludesFile in the shadow repo, none of which are confirmed in the official documentation. Its only feature is an extension validation command with evaluation tests.

Originally published at https://aicoding-guide.com https://aicoding-guide.com/en/posts/gemini-cli-update-0-68/ . Gemini CLI v0.68.0 ships with no summary prose at all — the release page is just a list of pull requests. One feature; everything else is a fix. It looks unremarkable, but three of the fixes are about boundaries , and each one is a case where behaviour the docs already describe was not holding in some environment. Key point What you will learn - When --userns=keep-id is passed for rootless Podman, and how to override it- The fixes to root checks on Windows and to symlink resolution in GlobTool - That the new extension validation command and the hooks' SubagentStop are both absent from the docs The fix is fix sandbox : supply --userns=keep-id for rootless podman 30118 . This behaviour is documented, under "Linux UID/GID handling": Gemini CLI automatically handles user permissions in container sandboxes on Linux. When the sandbox runs as your host UID/GID the default on supported Linux distributions and you use rootless Podman, Gemini CLI also passes --userns=keep-id . This keeps files that the sandbox creates in mounted directories owned by your host user. To use a different user namespace mode, add your own --userns option to SANDBOX FLAGS . The promise is that files the sandbox writes into mounted directories stay owned by your host user. If ownership was turning into root under rootless Podman, that promise was not being kept until this release. There are three ways to select the backend, in a fixed order of precedence. | Method | How | |---|---| | Command flag | -s or --sandbox | | Environment variable | GEMINI SANDBOX=true\ | | Settings file | {% raw %} "sandbox": true inside the tools object of settings.json | Turn on sandboxing with rootless Podman export GEMINI SANDBOX=podman gemini Pick a different user namespace mode yourself export SANDBOX FLAGS="--userns=host" SANDBOX SET UID GID switches the mapping itself: true forces the host UID/GID, false disables UID/GID mapping. The other two concern which paths count as inside your working area. fix core : make isWithinRoot case-insensitive on Windows 29999 — root checks on Windows no longer depend on case, which matters if C:\Project and c:\project were being treated as different places fix core : resolve symlinked paths canonically in GlobTool 30042 — GlobTool now resolves symlinked paths canonically Neither behaviour is stated in the documentation The workspace concept itself is documented. The sandbox page says "the sandbox only has access to the current project workspace" and points you at SANDBOX MOUNTS when something outside it must be reachable. But whether path comparison is case-sensitive on Windows, and how the file tools resolve symlinks, could not be confirmed in the official documentation. The PR titles tell you what changed; no specification-level statement exists. If you need the outside of the workspace genuinely blocked, turn the sandbox on and pass what you need explicitly with SANDBOX MOUNTS . There is also a fix about git's exclude files: fix core : honor .git/info/exclude and core.excludesFile in shadow repo 30034 . Here too, no documented statement that .git/info/exclude or core.excludesFile are honored could be found. These are the exclude settings that are documented: | Setting | What it does | |---|---| | context.fileFiltering.respectGitIgnore | Respect .gitignore default true | | context.fileFiltering.respectGeminiIgnore | Respect .geminiignore default true | | context.fileFiltering.customIgnoreFilePaths | Additional ignore file paths, which take precedence over .geminiignore and .gitignore | If you want an extra ignore file to count on, naming it in customIgnoreFilePaths is the documented route. The release's only feature is feat cli : add extension validation command and evaluation tests 29980 . But as of 2026-11-16 no validate subcommand appears in the official documentation. The documented gemini extensions subcommands are: install / uninstall / disable / enable / update / new / link / list / config The slash-command form, /extensions , lists ten: config , disable , enable , explore , install , link , list , restart , uninstall , update . No validate . There is a hooks fix too: fix hooks : support SubagentStop event mapping and merge hook definitions 30111 . Read that one carefully. SubagentStop does not appear in the documented list of hook events. The documented events are these eleven: SessionStart / SessionEnd / BeforeAgent / AfterAgent / BeforeModel / AfterModel BeforeToolSelection / BeforeTool / AfterTool / PreCompress / Notification SubagentStop is a Claude Code event name. Gemini CLI does carry a compatibility environment variable, CLAUDE PROJECT DIR , so this could plausibly be about mapping a migrated Claude Code configuration — but no official statement to that effect could be found. For the hooks' timeout being in milliseconds default 60000 , see Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration https://aicoding-guide.com/en/posts/gemini-cli-update-0-67/ . Three concern model selection. fix core,cli : preserve selected model across transient fallback, cancel, and rewind 30059 — your chosen model survives a transient fallback, a cancel, and a rewind fix core : preserve explicit gemini-2.5-flash model in dynamic model resolution 30057 — an explicitly chosen gemini-2.5-flash is not replaced by dynamic resolution fix core : list Auto in /model when dynamicModelConfiguration is enabled and preview access is disabled 29998 The one you are most likely to notice day to day is fix cli : surface 429 rate limit cool-down and countdown in loading indicator 30012 : when you hit a rate limit, the cool-down and a countdown now appear in the loading indicator. For the free-tier ceilings, see Gemini CLI free tier limits and how paid plans differ https://aicoding-guide.com/en/posts/gemini-cli-free-tier-limits/ . On extensions, concurrent installs are now serialized with a per-extension lock 30039 , and stream failures during extension release downloads are handled 30100 . For MCP server configuration, see Add an MCP server to Gemini CLI https://aicoding-guide.com/en/posts/gemini-cli-mcp/ . --userns=keep-id , which is documented behaviour; to use another mode, add --userns to SANDBOX FLAGS yourself SubagentStop are both missing from the official documentation