I can't run gemini cli with my own docker image, it always loads the default sandbox image

[bitic]

Hi,

I'm using gemini cli 0.34.0 and I added this to my ~/.gemini/settings.json but gemini ignores sandboxImage

  "tools": {
    "sandbox": "docker",
    "sandboxImage": "gemini-custom-sandbox-bitic-v1"
  }

It should find my image.

❯ docker images
REPOSITORY                                             TAG       IMAGE ID       CREATED        SIZE
gemini-custom-sandbox-bitic-v1                     latest    5be21d22e474   2 hours ago    3.93GB
<none>                                                 <none>    13cac4c13c8e   2 hours ago    1.03GB
us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox   0.34.0    2c5dc1ab2749   38 hours ago   1.17GB
pquintana-minimal                                      latest    1745c1d19280   6 months ago   357MB
us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox   0.1.1     150868f0b639   8 months ago   756MB

As a result, gemini is always using sandbox 0.34, instead of my image. Therefore I don't have access to some needed tools.

I also tried setting GEMINI_SANDBOX_IMAGE and it doesn't work.

What can I do? Any ideas? Thanks! :-)

[chrikrah]

@bitic sandboxImage is not a settings key in 0.34.0, so nothing reads yours.

loadSandboxConfig takes the command from settings, and the image only from the environment or the packaged default:

$ npm install @google/gemini-cli@0.34.0
$ sed -n '81,89p' node_modules/@google/gemini-cli/dist/src/config/sandboxConfig.js
export async function loadSandboxConfig(settings, argv) {
    const sandboxOption = argv.sandbox ?? settings.tools?.sandbox;
    const command = getSandboxCommand(sandboxOption);
    const packageJson = await getPackageJson(__dirname);
    const image = process.env['GEMINI_SANDBOX_IMAGE'] ??
        process.env['GEMINI_SANDBOX_IMAGE_DEFAULT'] ??
        packageJson?.config?.sandboxImageUri;
    return command && image ? { command, image } : undefined;
}

Calling it with your exact block, then with the environment variable:

$ node --input-type=module -e '
const {loadSandboxConfig} = await import("./node_modules/@google/gemini-cli/dist/src/config/sandboxConfig.js");
console.log(JSON.stringify(await loadSandboxConfig({tools:{sandbox:"docker",sandboxImage:"gemini-custom-sandbox-bitic-v1"}},{})));
process.env.GEMINI_SANDBOX_IMAGE="gemini-custom-sandbox-bitic-v1";
console.log(JSON.stringify(await loadSandboxConfig({tools:{sandbox:"docker"}},{})));'
{"command":"docker","image":"us-docker.pkg.dev/gemini-code-dev/gemini-cli/sandbox:0.34.0"}
{"command":"docker","image":"gemini-custom-sandbox-bitic-v1"}

So on 0.34.0 the environment variable is the only route to a custom image.

0.35.0 added a settings route, image inside the tools.sandbox object, which also needs enabled: true or the sandbox switches off:

$ npm install @google/gemini-cli@0.35.0
$ node --input-type=module -e '
const {loadSandboxConfig} = await import("./node_modules/@google/gemini-cli/dist/src/config/sandboxConfig.js");
console.log(JSON.stringify(await loadSandboxConfig({tools:{sandbox:{enabled:true,command:"docker",image:"gemini-custom-sandbox-bitic-v1"}}},{})));'
{"enabled":true,"allowedPaths":[],"networkAccess":false,"command":"docker","image":"gemini-custom-sandbox-bitic-v1"}

That landed in e3b3b71 (#21774), first tagged v0.35.0, and v0.62.0 still resolves it the same way (customImage = config.image in packages/cli/src/config/sandboxConfig.ts:146), with no sandboxImage key anywhere in the schema.

# not run: a real `docker run`, so only the resolved image string was measured
# note: a `docker` binary must be on PATH or getSandboxCommand throws before the image is read

If you are still on 0.34.0, GEMINI_SANDBOX_IMAGE=gemini-custom-sandbox-bitic-v1 gemini ... on one line is the whole fix; upgrading gets you the settings key. Which version are you on now?

[bitic]

I moved on, I'm no longer using Gemini CLI.