Gemini CLI v0.68 fixes rootless Podman sandboxing and path boundary checks

Originally published at https://aicoding-guide.com.

Gemini CLI v0.68.0 ships with no summary prose at all — the release page is just a list of pull requests. One feature; everything else is a fix.

It looks unremarkable, but three of the fixes are about boundaries, and each one is a case where behaviour the docs already describe was not holding in some environment.

Key point
What you will learn

• When --userns=keep-id is passed for rootless Podman, and how to override it
• The fixes to root checks on Windows and to symlink resolution in GlobTool
• That the new extension validation command and the hooks' SubagentStop are both absent from the docs

--userns=keep-id reaches rootless Podman

The fix is fix(sandbox): supply --userns=keep-id for rootless podman (#30118). This behaviour is documented, under "Linux UID/GID handling":

Gemini CLI automatically handles user permissions in container sandboxes on Linux. When the sandbox runs as your host UID/GID (the default on supported Linux distributions) and you use rootless Podman, Gemini CLI also passes --userns=keep-id. This keeps files that the sandbox creates in mounted directories owned by your host user. To use a different user namespace mode, add your own --userns option to SANDBOX_FLAGS.

The promise is that files the sandbox writes into mounted directories stay owned by your host user. If ownership was turning into root under rootless Podman, that promise was not being kept until this release.

There are three ways to select the backend, in a fixed order of precedence.

Method	How
Command flag	-s or --sandbox
Environment variable	`GEMINI_SANDBOX=true\
Settings file	{% raw %}"sandbox": true inside the tools object of settings.json

# Turn on sandboxing with rootless Podman
export GEMINI_SANDBOX=podman
gemini

# Pick a different user namespace mode yourself
export SANDBOX_FLAGS="--userns=host"

SANDBOX_SET_UID_GID switches the mapping itself: true forces the host UID/GID, false disables UID/GID mapping.

Two fixes to path boundary checks

The other two concern which paths count as inside your working area.

• fix(core): make isWithinRoot case-insensitive on Windows (#29999) — root checks on Windows no longer depend on case, which matters if C:\Project and c:\project were being treated as different places
• fix(core): resolve symlinked paths canonically in GlobTool (#30042) — GlobTool now resolves symlinked paths canonically

Neither behaviour is stated in the documentation
The workspace concept itself is documented. The sandbox page says "the sandbox only has access to the current project workspace" and points you at SANDBOX_MOUNTS when something outside it must be reachable.

But whether path comparison is case-sensitive on Windows, and how the file tools resolve symlinks, could not be confirmed in the official documentation. The PR titles tell you what changed; no specification-level statement exists. If you need the outside of the workspace genuinely blocked, turn the sandbox on and pass what you need explicitly with SANDBOX_MOUNTS.

There is also a fix about git's exclude files: fix(core): honor .git/info/exclude and core.excludesFile in shadow repo (#30034). Here too, no documented statement that .git/info/exclude or core.excludesFile are honored could be found. These are the exclude settings that are documented:

Setting	What it does
context.fileFiltering.respectGitIgnore	Respect .gitignore (default true)
context.fileFiltering.respectGeminiIgnore	Respect .geminiignore (default true)
context.fileFiltering.customIgnoreFilePaths	Additional ignore file paths, which take precedence over .geminiignore and .gitignore

If you want an extra ignore file to count on, naming it in customIgnoreFilePaths is the documented route.

The extension validation command and the hooks' SubagentStop

The release's only feature is feat(cli): add extension validation command and evaluation tests (#29980). But as of 2026-11-16 no validate subcommand appears in the official documentation. The documented gemini extensions subcommands are:

install / uninstall / disable / enable / update / new / link / list / config

The slash-command form, /extensions, lists ten: config, disable, enable, explore, install, link, list, restart, uninstall, update. No validate.

There is a hooks fix too: fix(hooks): support SubagentStop event mapping and merge hook definitions (#30111). Read that one carefully. SubagentStop does not appear in the documented list of hook events. The documented events are these eleven:

SessionStart / SessionEnd / BeforeAgent / AfterAgent / BeforeModel / AfterModel
BeforeToolSelection / BeforeTool / AfterTool / PreCompress / Notification

SubagentStop is a Claude Code event name. Gemini CLI does carry a compatibility environment variable, CLAUDE_PROJECT_DIR, so this could plausibly be about mapping a migrated Claude Code configuration — but no official statement to that effect could be found. For the hooks' timeout being in milliseconds (default 60000), see Gemini CLI v0.67 adds a models command and fixes the unit in Claude hook migration.

The other fixes

Three concern model selection.

• fix(core,cli): preserve selected model across transient fallback, cancel, and rewind (#30059) — your chosen model survives a transient fallback, a cancel, and a rewind
• fix(core): preserve explicit gemini-2.5-flash model in dynamic model resolution (#30057) — an explicitly chosen gemini-2.5-flash is not replaced by dynamic resolution
• fix(core): list Auto in /model when dynamicModelConfiguration is enabled and preview access is disabled (#29998)

The one you are most likely to notice day to day is fix(cli): surface 429 rate limit cool-down and countdown in loading indicator (#30012): when you hit a rate limit, the cool-down and a countdown now appear in the loading indicator. For the free-tier ceilings, see Gemini CLI free tier limits and how paid plans differ.

On extensions, concurrent installs are now serialized with a per-extension lock (#30039), and stream failures during extension release downloads are handled (#30100). For MCP server configuration, see Add an MCP server to Gemini CLI.

Summary

• v0.68.0 has no summary prose in its release notes: one feature and 28 fixes
• Rootless Podman gets --userns=keep-id, which is documented behaviour; to use another mode, add --userns to SANDBOX_FLAGS yourself
• Root checks on Windows and GlobTool symlink resolution were fixed, but neither is described as a specification in the docs
• The new extension validation command and the hooks' SubagentStop are both missing from the official documentation