Gemini CLI 0.58.0 closes a sandbox escape that ran through the Docker socket

A sandbox holds only for what the sandboxed process does itself. Gemini CLI confines work in a macOS Seatbelt profile, and until version 0.58.0 that profile left the local container runtime reachable. Asking a privileged container to mount the host filesystem is not something Seatbelt inspects, because the mount is performed by a daemon that was never inside the sandbox.

How the escape worked

On a machine running macOS with Docker Desktop, OrbStack, Colima or Rancher Desktop active, the Seatbelt profile allowed broad process execution, file reading and outbound networking. That combination was enough. A sandboxed process could reach the container daemon socket, start a privileged container, and have it mount the host filesystem through VirtioFS. The files then arrived from outside the Seatbelt boundary, so the boundary did not apply to them.

None of this requires a bug in Seatbelt. Seatbelt restricted the process; it did not restrict what that process could ask another daemon to do on its behalf. That is the general shape of the problem, and it is worth carrying into any sandbox review: the boundary covers direct actions, not delegated ones.

What the profile now denies

The change was merged on August 21, 2026. It applies to the dynamic profile builder in the core package and to all six built-in macOS Seatbelt profiles, and it refuses four categories of access outright.

• Reads and writes to container daemon sockets, including /var/run/docker.sock, /private/var/run/docker.sock, /Users/Shared/.docker and user-level runtime paths under ~/.docker/, ~/.colima/, ~/.orbstack/ and ~/.rd/.
• Execution of the container binaries docker, dockerd, docker-compose, podman, colima and orb in the usual install locations, among them /usr/local/bin, /opt/homebrew/bin and application bundles.
• Mach service lookups for names beginning with com.docker. and for OrbStack's service name.
• POSIX shared memory whose name carries a Docker-related prefix.

11 days between the fix and the stable release

The commit landed on August 21, 2026, and the first stable release carrying it is 0.58.0, on September 1, 2026. By our own count that is 11 days, during which everyone on the 0.57 line was still running the old profiles. The release notes do not mark the entry as a security fix; it is listed between a symlink handling fix and a write-policy fix, in the same typeface as everything else.

The rest of 0.58.0 is small. Ignore-path handling now evaluates symlinks consistently, the write policy configuration declares its top-level safety checkers, and the agent server clears a stale cancellation error when a new message turn begins.