google-gemini/gemini-cli · error · FatalSandboxError

Missing mount path '${from}' listed in SANDBOX_MOUNTS

Error message

Missing mount path '${from}' listed in SANDBOX_MOUNTS

What it means

Thrown while parsing SANDBOX_MOUNTS when a mount source path (`from`) is absolute but does not exist on the host filesystem (fs.existsSync returns false). Mounting a nonexistent host path causes Docker to create an empty directory owned by root, which is rarely intended, so it is rejected up front.

Source

Thrown at packages/cli/src/utils/sandbox.ts:488

    // mount paths listed in SANDBOX_MOUNTS
    if (process.env['SANDBOX_MOUNTS']) {
      for (let mount of process.env['SANDBOX_MOUNTS'].split(',')) {
        if (mount.trim()) {
          // parse mount as from:to:opts
          let [from, to, opts] = mount.trim().split(':');
          to = to || from; // default to mount at same path inside container
          opts = opts || 'ro'; // default to read-only
          mount = `${from}:${to}:${opts}`;
          // check that from path is absolute
          if (!path.isAbsolute(from)) {
            throw new FatalSandboxError(
              `Path '${from}' listed in SANDBOX_MOUNTS must be absolute`,
            );
          }
          // check that from path exists on host
          if (!fs.existsSync(from)) {
            throw new FatalSandboxError(
              `Missing mount path '${from}' listed in SANDBOX_MOUNTS`,
            );
          }
          debugLogger.log(`SANDBOX_MOUNTS: ${from} -> ${to} (${opts})`);
          args.push('--volume', mount);
        }
      }
    }

    // mount paths listed in config.allowedPaths
    if (config.allowedPaths) {
      for (const hostPath of config.allowedPaths) {
        if (hostPath && path.isAbsolute(hostPath) && fs.existsSync(hostPath)) {
          const containerPath = getContainerPath(hostPath);
          debugLogger.log(
            `Config allowedPath: ${hostPath} -> ${containerPath} (ro)`,
          );
          args.push('--volume', `${hostPath}:${containerPath}:ro`);

View on GitHub (pinned to 5024443c72)

Solutions

1. Create the missing host directory: `mkdir -p /opt/data`.
2. Correct the path in SANDBOX_MOUNTS to the actual location.
3. Ensure any service that populates the directory runs before the sandbox starts.

Example fix

// before
// SANDBOX_MOUNTS=/opt/missing:/data:ro

// after
// mkdir -p /opt/missing
// SANDBOX_MOUNTS=/opt/missing:/data:ro

const fs = require('fs');
const path = require('path');
function ensureMountsExist(mountsStr) {
  for (const raw of (mountsStr || '').split(',')) {
    const m = raw.trim();
    if (!m) continue;
    const from = m.split(':')[0];
    if (path.isAbsolute(from) && !fs.existsSync(from)) {
      fs.mkdirSync(from, {recursive:true});
    }
  }
}

When it happens

Trigger: SANDBOX_MOUNTS contains an absolute path like /opt/data:/data but /opt/data does not exist on the host. Occurs right after the absolute-path check at sandbox.ts:482.

Common situations: Path was correct on a different machine. Typo in the absolute path. The directory is created by a sibling service that hasn't run yet. Mounting a path inside a container that was never bind-created on the host.

Related errors

• Path '${from}' listed in SANDBOX_MOUNTS must be absolute
• SANDBOX_ENV must be a comma-separated list of key=value pair
• Security violation: The path "${trimmedPath}" is outside the
• The path "${trimmedPath}" is not a directory.
• The path "${trimmedPath}" does not exist.

AI-assisted analysis of google-gemini/gemini-cli@5024443c72 (2026-08-12). Data as JSON: /api/errors/882a93b896b9602f. Report an issue: GitHub.