Gemini CLI Closes a macOS Seatbelt Escape Through the Docker Desktop Socket

GitHub·high signalXBlueskyLinkedInCopy link

PR #28935, shipped in gemini-cli v0.58.0-preview.0 on 2026-08-25, denies sandboxed processes access to container runtime daemon sockets (`/var/run/docker.sock`, `~/.colima/`, `~/.orbstack/`, `~/.rd/`), the docker/dockerd/podman/colima/orb binaries, and container Mach/XPC lookups and POSIX shared memory. On any Mac with Docker Desktop or OrbStack running, the previous Seatbelt profile allowed enough process execution and outbound networking to talk to the container daemon and escape via hypervisor filesystem mounts such as VirtioFS. Local-sandbox agents on macOS inherit this whole class: your seatbelt profile is only as tight as the most privileged daemon socket it leaves reachable.