Gemini CLI

noneopen sourcecli

Sandbox is off by default; on Linux the only isolation option is a container (Docker/Podman), not native confinement.

By default commands run with your full privileges gated only by an approval prompt. Sandboxing is opt-in (enabling YOLO auto-enables it as a partial net). On Linux there is no native confinement, isolation is container-only via Docker or Podman, so a Linux user without a container engine gets no OS isolation. macOS offers Seatbelt with six selectable profiles (permissive/restrictive × open/closed/proxied).

Isolation tech (linux)

Docker Podman

Isolation tech (macos)

Seatbelt (macOS App Sandbox)

Escape hatch

--yolo

Sources

google-gemini/gemini-cli