Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
The patch blocks the docker.sock, OrbStack, and Colima paths that let a sandboxed process reach the container daemon and escape through VirtioFS.
Why now: The fix is scoped to v0.58.0-preview.0, ahead of a stable release.
Gemini CLI's macOS sandbox left a hole big enough to reach Docker's daemon, until PR #28935 closed it in v0.58.0-preview.0.
On any Mac running Docker Desktop or OrbStack, the old Seatbelt profile let a sandboxed process execute code. It could also reach far enough over the network to talk to the container daemon socket. From there, a VirtioFS mount gave it a way off the sandbox and onto the host filesystem.
The patch denies access to /var/run/docker.sock, the colima, orbstack, and rd config directories, and the docker, podman, colima, and orb binaries. It also blocks the Mach and XPC lookups a process would use to find those services before it ever touches the socket.
A Seatbelt profile has to name every privileged socket on the machine, not just the ones the tool ships with. Docker Desktop and OrbStack sit on plenty of Mac dev machines. The same class of escape is a real risk in other sandboxed CLI tools that never checked what's listening on /var/run.
Each link below shares sources, entities, or timing with this story.
Claude Code uses Seatbelt / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Docker Desktop, Gemini CLI; overlapping topics (daemon, docker).
Claude Code uses Seatbelt / Shared entity: Gemini CLI / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Claude Code uses Seatbelt / Shared entity: Gemini CLI / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Claude Code uses Seatbelt / Shared entity: Gemini CLI / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; reported by the same outlet (github.com).
Claude Code uses Seatbelt / Shared entity: Gemini CLI / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Seatbelt); both cover Gemini CLI; overlapping topics (desktop, gemini).