---
source: https://iinventedlight.com/library/notes/ao-security-gemini-cli-sandbox.md
title: "Sandboxing and trusted folders in Gemini CLI"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "Apache-2.0 or MIT (repo docs; LICENSE file verified in each GitHub repo); prose restates cited source lines in own words"
license_family: agentops-green
attribution: "Summary by iinventedlight (AI-assisted). Sources: Google Gemini CLI docs (GitHub), Sandboxing in Gemini CLI, Apache-2.0 (google-gemini/gemini-cli LICENSE); Google Gemini CLI docs (GitHub), Trusted Folders, Apache-2.0 (google-gemini/gemini-cli LICENSE)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-09
status: published
checked_on: 2026-11-09
as_of: 2026-11-09
confidence: medium
untested: "No tool or code was run for this note; only the fetched repository documentation was read."
category: agent-operations
topic_area: "agent operations: agent security"
tags: [gemini-cli, sandbox, security, trusted-folders]
client: Librarian
sources:
  - id: S1
    title: "Sandboxing in Gemini CLI"
    publisher: Google Gemini CLI docs (GitHub)
    url: https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/sandbox.md
    accessed: 2026-11-09
    license: "Apache-2.0 (google-gemini/gemini-cli LICENSE)"
  - id: S2
    title: "Trusted Folders"
    publisher: Google Gemini CLI docs (GitHub)
    url: https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/trusted-folders.md
    accessed: 2026-11-09
    license: "Apache-2.0 (google-gemini/gemini-cli LICENSE)"
---
# Sandboxing and trusted folders in Gemini CLI

**Answer:** Sandboxing keeps potentially dangerous operations, like shell commands or file modifications, isolated from your host system. Trusted Folders asks you to approve a folder before project-specific configurations load.

## Turning the sandbox on (precedence order)

1. Command flag: `--sandbox`, or `-s`.
2. Environment variable: `GEMINI_SANDBOX` (true, docker, podman, sandbox-exec, runsc, or lxc).
3. Settings file: set `sandbox` to true under `tools` in `settings.json`.

## Methods

- macOS Seatbelt uses `sandbox-exec`. The default profile `permissive-open` confines writes to the project directory while allowing broad file reads and network access. Stricter profiles add read restrictions or a network proxy.
- Container-based sandboxing (Docker/Podman) gives complete process isolation.

## Trusted Folders

The feature is disabled by default. Once enabled, the first run in a folder asks: trust folder, trust parent folder, or don't trust. Untrusted folders run in a restricted safe mode. The choice is saved in a central file (`~/.gemini/trustedFolders.json`).

## Artifacts

- [Agent security controls (summary) (table)](https://iinventedlight.com/library/artifacts/ao-security-sandbox.table.json)
- [Agent security controls (summary) (markdown table)](https://iinventedlight.com/library/artifacts/ao-security-sandbox.table.md)
- [Topic packet: ao-security](https://iinventedlight.com/library/packets/ao-security.json)

## See also

- [ao-security-guardrail-layers](https://iinventedlight.com/library/notes/ao-security-guardrail-layers/)
- [ao-security-prompt-injection-design](https://iinventedlight.com/library/notes/ao-security-prompt-injection-design/)
- [ao-mcp-transports-and-trust](https://iinventedlight.com/library/notes/ao-mcp-transports-and-trust/)

## Claims

- id: C1
  claim: Sandboxing isolates dangerous operations from the host.
  source: S1
  evidence: "isolates potentially dangerous operations (such as shell commands or file modifications) from your host system"

- id: C2
  claim: The default Seatbelt profile confines writes to the project.
  source: S1
  evidence: "confines writes to the project directory while allowing broad file reads and network access."

- id: C3
  claim: Trusted Folders is off by default.
  source: S2
  evidence: "The Trusted Folders feature is **disabled by default**."

- id: C4
  claim: Untrusted folders run in safe mode.
  source: S2
  evidence: "The CLI will operate in a restricted \"safe mode.\""

## Sources

- [S1] Sandboxing in Gemini CLI. Google Gemini CLI docs (GitHub). https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/sandbox.md . License: Apache-2.0 (google-gemini/gemini-cli LICENSE). Accessed 2026-11-09.

- [S2] Trusted Folders. Google Gemini CLI docs (GitHub). https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/trusted-folders.md . License: Apache-2.0 (google-gemini/gemini-cli LICENSE). Accessed 2026-11-09.


License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Sources: GitHub repository docs under Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) or MIT License (https://opensource.org/licenses/MIT), as listed per source; copyright notices remain with the original authors. Text was condensed and changed from the originals.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).