← All notes

Answer: Sandboxing keeps potentially dangerous operations, like shell commands or file modifications, isolated from your host system. Trusted Folders asks you to approve a folder before project-specific configurations load.

Turning the sandbox on (precedence order)

1. Command flag: --sandbox, or -s.
2. Environment variable: GEMINI_SANDBOX (true, docker, podman, sandbox-exec, runsc, or lxc).
3. Settings file: set sandbox to true under tools in settings.json.

Methods

• macOS Seatbelt uses sandbox-exec. The default profile permissive-open confines writes to the project directory while allowing broad file reads and network access. Stricter profiles add read restrictions or a network proxy.
• Container-based sandboxing (Docker/Podman) gives complete process isolation.

Trusted Folders

The feature is disabled by default. Once enabled, the first run in a folder asks: trust folder, trust parent folder, or don't trust. Untrusted folders run in a restricted safe mode. The choice is saved in a central file (~/.gemini/trustedFolders.json).

Artifacts

• Agent security controls (summary) (table)
• Agent security controls (summary) (markdown table)
• Topic packet: ao-security

See also

• ao-security-guardrail-layers
• ao-security-prompt-injection-design
• ao-mcp-transports-and-trust

Claims

• id: C1 claim: Sandboxing isolates dangerous operations from the host. source: S1 evidence: "isolates potentially dangerous operations (such as shell commands or file modifications) from your host system"

• id: C2 claim: The default Seatbelt profile confines writes to the project. source: S1 evidence: "confines writes to the project directory while allowing broad file reads and network access."

• id: C3 claim: Trusted Folders is off by default. source: S2 evidence: "The Trusted Folders feature is disabled by default."

• id: C4 claim: Untrusted folders run in safe mode. source: S2 evidence: "The CLI will operate in a restricted \"safe mode.\""

Sources

• [S1] Sandboxing in Gemini CLI. Google Gemini CLI docs (GitHub). https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/sandbox.md . License: Apache-2.0 (google-gemini/gemini-cli LICENSE). Accessed 2026-11-09.

• [S2] Trusted Folders. Google Gemini CLI docs (GitHub). https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/trusted-folders.md . License: Apache-2.0 (google-gemini/gemini-cli LICENSE). Accessed 2026-11-09.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted). Sources: GitHub repository docs under Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) or MIT License (https://opensource.org/licenses/MIT), as listed per source; copyright notices remain with the original authors. Text was condensed and changed from the originals.

@misc{iil_note_zqrg13r5,
  author = {{iinventedlight}},
  title = {{Sandboxing and trusted folders in Gemini CLI}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-09},
  url = {https://iinventedlight.com/library/notes/ao-security-gemini-cli-sandbox/},
  note = {Permanent ID iil:note:zqrg13r5. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt | /agents.md | /.well-known/agent-library.json. This page in Markdown: /library/notes/ao-security-gemini-cli-sandbox.md.