Frequently Asked Question

How does Gemini CLI sandboxing differ from Claude Code and Codex?

It delegates the whole problem to a container runtime rather than assembling a sandbox from kernel primitives.

Enable it with -s or --sandbox, or set the GEMINI_SANDBOX environment variable to select the backend: docker, podman, runsc for gVisor, or lxc. Your working directory mounts at the same absolute path inside the container as outside, so paths in the conversation match paths on disk.

The case for this approach is that the isolation boundary is not the agent vendor's own code. Docker, Podman, and gVisor are widely deployed and heavily scrutinised, and a container is a familiar unit your team already knows how to inspect and destroy. The case against is friction: a runtime must be installed and running, startup adds latency, and reaching host resources such as a GPU needs explicit plumbing.

Claude Code and Codex invert those trade-offs, using bubblewrap, namespaces, and seccomp directly. Nothing to install and no startup cost, but the confining logic is the agent's own.