Run the agent's tools inside a sandbox
tools & sandbox
// what it does
-s (--sandbox) isolates file writes and shell commands from the rest of your system. On macOS it uses the built-in Seatbelt with the permissive-open profile by default; cross-platform it runs in Docker or Podman. Choose the backend with GEMINI_SANDBOX (true, docker, podman, or sandbox-exec) or tools.sandbox in settings.json.
// shell
$ gemini -s -p "run the test suite and fix failures"$ export GEMINI_SANDBOX=docker// gotcha
The Docker and Podman backends need a sandbox image pulled and the daemon running, or the session fails to start — Seatbelt (macOS) has no such dependency. Tighten or loosen the macOS profile with SEATBELT_PROFILE (permissive-open through restrictive-closed).