MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-03-19 18:40:57 -07:00
Code Issues Packages Projects Releases Wiki Activity

feat(sandbox): add experimental LXC container sandbox support (#20735)

Browse Source
This commit is contained in:
Himanshu Soni
2026-03-04 23:14:33 +05:30
committed by GitHub
parent bc89b05f01
commit 717660997d
9 changed files with 389 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
packages/cli/src/config/sandboxConfig.test.ts
View File

@@ -97,7 +97,7 @@ describe('loadSandboxConfig', () => {
it('should throw if GEMINI_SANDBOX is an invalid command', async () => {
process.env['GEMINI_SANDBOX'] = 'invalid-command';
await expect(loadSandboxConfig({}, {})).rejects.toThrow(
"Invalid sandbox command 'invalid-command'. Must be one of docker, podman, sandbox-exec",
"Invalid sandbox command 'invalid-command'. Must be one of docker, podman, sandbox-exec, lxc",
);
});
@@ -108,6 +108,22 @@ describe('loadSandboxConfig', () => {
"Missing sandbox command 'docker' (from GEMINI_SANDBOX)",
);
});
it('should use lxc if GEMINI_SANDBOX=lxc and it exists', async () => {
process.env['GEMINI_SANDBOX'] = 'lxc';
mockedCommandExistsSync.mockReturnValue(true);
const config = await loadSandboxConfig({}, {});
expect(config).toEqual({ command: 'lxc', image: 'default/image' });
expect(mockedCommandExistsSync).toHaveBeenCalledWith('lxc');
});
it('should throw if GEMINI_SANDBOX=lxc but lxc command does not exist', async () => {
process.env['GEMINI_SANDBOX'] = 'lxc';
mockedCommandExistsSync.mockReturnValue(false);
await expect(loadSandboxConfig({}, {})).rejects.toThrow(
"Missing sandbox command 'lxc' (from GEMINI_SANDBOX)",
);
});
});
describe('with sandbox: true', () => {

4
packages/cli/src/config/sandboxConfig.ts
View File

@@ -27,6 +27,7 @@ const VALID_SANDBOX_COMMANDS: ReadonlyArray<SandboxConfig['command']> = [
'docker',
'podman',
'sandbox-exec',
'lxc',
];
function isSandboxCommand(value: string): value is SandboxConfig['command'] {
@@ -91,6 +92,9 @@ function getSandboxCommand(
}
return '';
// Note: 'lxc' is intentionally not auto-detected because it requires a
// pre-existing, running container managed by the user. Use
// GEMINI_SANDBOX=lxc or sandbox: "lxc" in settings to enable it.
}
export async function loadSandboxConfig(

3
packages/cli/src/config/settingsSchema.ts
View File

@@ -1236,7 +1236,8 @@ const SETTINGS_SCHEMA = {
ref: 'BooleanOrString',
description: oneLine`
Sandbox execution environment.
Set to a boolean to enable or disable the sandbox, or provide a string path to a sandbox profile.
Set to a boolean to enable or disable the sandbox, provide a string path to a sandbox profile,
or specify an explicit sandbox command (e.g., "docker", "podman", "lxc").
`,
showInDialog: false,
},