{"record":{"id":"cdfa2e4dd18f13f0","repo":"google-gemini/gemini-cli","slug":"proxy-container-command-command-proxycontain","errorCode":null,"errorMessage":"Proxy container command '${command} ${proxyContainerArgs.join(' ')}' exited with code ${code}, signal ${signal}","messagePattern":"Proxy container command '(.+?) (.+?)' exited with code (.+?), signal (.+?)","errorType":"exception","errorClass":"FatalSandboxError","httpStatus":null,"severity":"critical","filePath":"packages/cli/src/utils/sandbox.ts","lineNumber":851,"sourceCode":"            stdio: 'ignore',\n          });\n        } catch {\n          // ignore\n        }\n      };\n\n      // commented out as it disrupts ink rendering\n      // proxyProcess.stdout?.on('data', (data) => {\n      //   console.info(data.toString());\n      // });\n      proxyProcess.stderr?.on('data', (data) => {\n        debugLogger.debug(`[PROXY STDERR]: ${data.toString().trim()}`);\n      });\n      proxyProcess.on('close', (code, signal) => {\n        if (sandboxProcess?.pid) {\n          process.kill(-sandboxProcess.pid, 'SIGTERM');\n        }\n        throw new FatalSandboxError(\n          `Proxy container command '${command} ${proxyContainerArgs.join(' ')}' exited with code ${code}, signal ${signal}`,\n        );\n      });\n      debugLogger.log('waiting for proxy to start ...');\n      await execAsync(\n        `until timeout 0.25 curl -s http://localhost:8877; do sleep 0.25; done`,\n      );\n      // connect proxy container to sandbox network\n      // (workaround for older versions of docker that don't support multiple --network args)\n      await execAsync(\n        `${command} network connect ${SANDBOX_NETWORK_NAME} ${SANDBOX_PROXY_NAME}`,\n      );\n    }\n\n    // spawn child and let it inherit stdio\n    process.stdin.pause();\n    sandboxProcess = spawn(command, args, {\n      stdio: 'inherit',","sourceCodeStart":833,"sourceCodeEnd":869,"githubUrl":"https://github.com/google-gemini/gemini-cli/blob/5024443c7217464a66e98f80d73172a26440bd8f/packages/cli/src/utils/sandbox.ts#L833-L869","documentation":"Thrown inside the close handler of the proxy container process when that process exits (with a code and signal) before the sandbox session completes. The proxy container brokers network access for the sandbox; its premature death is fatal. Note: throwing inside an async event handler ('close') will not be catchable by the caller's try/catch and surfaces as an unhandled error.","triggerScenarios":"The proxy container command (command + proxyContainerArgs, e.g. docker run for SANDBOX_PROXY_NAME on port 8877) exits — crash, OOM kill, daemon restart, or manual stop — triggering proxyProcess.on('close'). The handler also sends SIGTERM to the sandbox process group before throwing.","commonSituations":"Proxy image missing or fails to start. Port 8877 already in use by another process. Docker daemon restarted mid-session. Resource limits (memory/CPU) killed the proxy container. Network creation/connection step failed and the proxy was torn down.","solutions":["Inspect proxy container logs: `docker logs <SANDBOX_PROXY_NAME>` (run right after the failure) for the root cause.","Ensure port 8877 is free: `lsof -i :8877` and stop any conflicting process.","Verify the proxy image exists and the Docker daemon has adequate memory/CPU.","Re-run the sandbox command; transient daemon issues often clear on retry."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const { execSync } = require('child_process');\n// Pre-flight checks before starting the sandbox with a proxy.\nexecSync('lsof -i :8877', {stdio:'ignore'}); // throws if free — invert logic in your helper\ntry { execSync(`docker image inspect ${SANDBOX_PROXY_IMAGE}`, {stdio:'ignore'}); }\ncatch { execSync(`docker pull ${SANDBOX_PROXY_IMAGE}`, {stdio:'inherit'}); }","typeGuard":null,"tryCatchPattern":"// Because the throw happens inside an event handler it cannot be caught by the caller.\n// Instead, listen on the proxy process yourself or check liveness after start.\nproxyProcess.on('close', (code, signal) => {\n  log.warn(`proxy exited code=${code} signal=${signal}`);\n  // graceful degradation / restart logic here\n});","preventionTips":["Reserve port 8877 exclusively for the sandbox proxy.","Give the proxy container adequate memory/CPU limits.","Monitor the proxy process and surface its logs to users."],"tags":["sandbox","proxy","docker","process","network","runtime"],"backgroundTag":null,"analyzedSha":"5024443c7217464a66e98f80d73172a26440bd8f","analyzedAt":"2026-08-12T06:01:53.711Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}