{"record":{"id":"6da6f0625f1c8f4f","repo":"google-gemini/gemini-cli","slug":"path-from-listed-in-sandbox-mounts-must-be-ab","errorCode":null,"errorMessage":"Path '${from}' listed in SANDBOX_MOUNTS must be absolute","messagePattern":"Path '(.+?)' listed in SANDBOX_MOUNTS must be absolute","errorType":"exception","errorClass":"FatalSandboxError","httpStatus":null,"severity":"error","filePath":"packages/cli/src/utils/sandbox.ts","lineNumber":612,"sourceCode":"    }\n\n    // mount paths listed in SANDBOX_MOUNTS\n    if (process.env['SANDBOX_MOUNTS']) {\n      for (let mount of process.env['SANDBOX_MOUNTS'].split(',')) {\n        if (mount.trim()) {\n          // parse mount as from:to:opts\n          let [from, to, opts] = mount.trim().split(':');\n          to = to || from; // default to mount at same path inside container\n          opts = opts || 'ro'; // default to read-only\n          mount = `${from}:${to}:${opts}`;\n          // check that from path is absolute\n          if (!path.isAbsolute(from)) {\n            throw new FatalSandboxError(\n              `Path '${from}' listed in SANDBOX_MOUNTS must be absolute`,\n            );\n          }\n          if (isSensitiveHostPath(from)) {\n            throw new FatalSandboxError(\n              `Mounting sensitive host path '${from}' listed in SANDBOX_MOUNTS is strictly prohibited`,\n            );\n          }\n          // check that from path exists on host\n          if (!fs.existsSync(from)) {\n            throw new FatalSandboxError(\n              `Missing mount path '${from}' listed in SANDBOX_MOUNTS`,\n            );\n          }\n          debugLogger.log(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);\n          args.push('--volume', mount);\n        }\n      }\n    }\n\n    // mount paths listed in config.allowedPaths\n    if (config.allowedPaths) {\n      for (const hostPath of config.allowedPaths) {","sourceCodeStart":594,"sourceCodeEnd":630,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/6a466a7e2fe2b1255752c1e74f69b31f0216084d/packages/cli/src/utils/sandbox.ts#L594-L630","documentation":"Thrown while parsing the SANDBOX_MOUNTS environment variable when a mount source path (`from`) is not absolute. Docker volume mounts require absolute host paths, so a relative path is rejected before it can produce a confusing Docker error. The mount string is parsed as from:to:opts (colon-delimited).","triggerScenarios":"SANDBOX_MOUNTS contains an entry like `./data:/data:ro` or `relative/path` where the `from` segment fails path.isAbsolute().","commonSituations":"User sets SANDBOX_MOUNTS=$(pwd)/data:/data but the shell expansion is quoted oddly leaving a relative prefix. Copying a mount example from docs that used a relative path. Defining SANDBOX_MOUNTS in a .env file with a path intended to be relative to the project.","solutions":["Prefix each `from` path with an absolute path, e.g. SANDBOX_MOUNTS=/home/me/project/data:/data:ro.","If scripting, expand with $(realpath ./data) or $PWD so the value is absolute at runtime.","Validate every entry in SANDBOX_MOUNTS resolves to an absolute path before launching the sandbox."],"exampleFix":"// before\n// SANDBOX_MOUNTS=./secrets:/secrets:ro\n\n// after\n// SANDBOX_MOUNTS=/home/me/secrets:/secrets:ro","handlingStrategy":"validation","validationCode":"const path = require('path');\nfunction validateSandboxMounts(mountsStr) {\n  for (const raw of (mountsStr || '').split(',')) {\n    const m = raw.trim();\n    if (!m) continue;\n    const from = m.split(':')[0];\n    if (!path.isAbsolute(from)) {\n      throw new Error(`SANDBOX_MOUNTS entry '${from}' must be absolute`);\n    }\n  }\n}","typeGuard":"const isAbsoluteMountEntry = (entry) => {\n  const from = entry.trim().split(':')[0];\n  return typeof entry === 'string' && from.length > 0 && path.isAbsolute(from);\n};","tryCatchPattern":null,"preventionTips":["Always expand mount paths with $PWD or $(realpath) in shell scripts so values are absolute.","Lint SANDBOX_MOUNTS in a pre-launch hook."],"tags":["sandbox","docker","mounts","validation","environment-variable","path"],"backgroundTag":null,"analyzedSha":"6a466a7e2fe2b1255752c1e74f69b31f0216084d","analyzedAt":"2026-09-16T18:14:43.978Z","contentChangedAt":"2026-09-16T18:14:43.978Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}