{"record":{"id":"6da6f0625f1c8f4f","repo":"google-gemini/gemini-cli","slug":"path-from-listed-in-sandbox-mounts-must-be-ab","errorCode":null,"errorMessage":"Path '${from}' listed in SANDBOX_MOUNTS must be absolute","messagePattern":"Path '(.+?)' listed in SANDBOX_MOUNTS must be absolute","errorType":"validation","errorClass":"FatalSandboxError","httpStatus":null,"severity":"error","filePath":"packages/cli/src/utils/sandbox.ts","lineNumber":482,"sourceCode":"        args.push(\n          '--env',\n          `GOOGLE_APPLICATION_CREDENTIALS=${getContainerPath(adcFile)}`,\n        );\n      }\n    }\n\n    // mount paths listed in SANDBOX_MOUNTS\n    if (process.env['SANDBOX_MOUNTS']) {\n      for (let mount of process.env['SANDBOX_MOUNTS'].split(',')) {\n        if (mount.trim()) {\n          // parse mount as from:to:opts\n          let [from, to, opts] = mount.trim().split(':');\n          to = to || from; // default to mount at same path inside container\n          opts = opts || 'ro'; // default to read-only\n          mount = `${from}:${to}:${opts}`;\n          // check that from path is absolute\n          if (!path.isAbsolute(from)) {\n            throw new FatalSandboxError(\n              `Path '${from}' listed in SANDBOX_MOUNTS must be absolute`,\n            );\n          }\n          // check that from path exists on host\n          if (!fs.existsSync(from)) {\n            throw new FatalSandboxError(\n              `Missing mount path '${from}' listed in SANDBOX_MOUNTS`,\n            );\n          }\n          debugLogger.log(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);\n          args.push('--volume', mount);\n        }\n      }\n    }\n\n    // mount paths listed in config.allowedPaths\n    if (config.allowedPaths) {\n      for (const hostPath of config.allowedPaths) {","sourceCodeStart":464,"sourceCodeEnd":500,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/utils/sandbox.ts#L464-L500","documentation":"Thrown while parsing the SANDBOX_MOUNTS environment variable when a mount source path (`from`) is not absolute. Docker volume mounts require absolute host paths, so a relative path is rejected before it can produce a confusing Docker error. The mount string is parsed as from:to:opts (colon-delimited).","triggerScenarios":"SANDBOX_MOUNTS contains an entry like `./data:/data:ro` or `relative/path` where the `from` segment fails path.isAbsolute().","commonSituations":"User sets SANDBOX_MOUNTS=$(pwd)/data:/data but the shell expansion is quoted oddly leaving a relative prefix. Copying a mount example from docs that used a relative path. Defining SANDBOX_MOUNTS in a .env file with a path intended to be relative to the project.","solutions":["Prefix each `from` path with an absolute path, e.g. SANDBOX_MOUNTS=/home/me/project/data:/data:ro.","If scripting, expand with $(realpath ./data) or $PWD so the value is absolute at runtime.","Validate every entry in SANDBOX_MOUNTS resolves to an absolute path before launching the sandbox."],"exampleFix":"// before\n// SANDBOX_MOUNTS=./secrets:/secrets:ro\n\n// after\n// SANDBOX_MOUNTS=/home/me/secrets:/secrets:ro","handlingStrategy":"validation","validationCode":"const path = require('path');\nfunction validateSandboxMounts(mountsStr) {\n  for (const raw of (mountsStr || '').split(',')) {\n    const m = raw.trim();\n    if (!m) continue;\n    const from = m.split(':')[0];\n    if (!path.isAbsolute(from)) {\n      throw new Error(`SANDBOX_MOUNTS entry '${from}' must be absolute`);\n    }\n  }\n}","typeGuard":"const isAbsoluteMountEntry = (entry) => {\n  const from = entry.trim().split(':')[0];\n  return typeof entry === 'string' && from.length > 0 && path.isAbsolute(from);\n};","tryCatchPattern":null,"preventionTips":["Always expand mount paths with $PWD or $(realpath) in shell scripts so values are absolute.","Lint SANDBOX_MOUNTS in a pre-launch hook."],"tags":["sandbox","docker","mounts","validation","environment-variable","path"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}