Repository navigation
feat(sandbox): add Windows platform detection in sandboxConfig.ts #20780
Description
Summary
Currently sandboxConfig.ts has no native sandbox path for Windows users. The platform selection logic at line 77 only checks for darwin (macOS Seatbelt). On Windows, GEMINI_SANDBOX=true either falls through to Docker/Podman (which requires manual installation) or throws an error if neither is present.
Current Behavior
// sandboxConfig.ts:75-93
if (os.platform() === 'darwin' && commandExists.sync('sandbox-exec')) {
return 'sandbox-exec';
} else if (commandExists.sync('docker') && sandbox === true) {
return 'docker';
}On Windows with GEMINI_SANDBOX=true and no Docker installed, this throws FatalSandboxError (exit code 44). macOS users get zero-config sandboxing via Seatbelt; Windows users get nothing.
Proposed Solution
Add 'appcontainer' as a native Windows sandbox backend using Windows AppContainer — the same OS-level isolation that UWP apps use. Available on all Windows editions since Windows 8.
Integration Points (following the LXC pattern from PR #20735)
- Type —
packages/core/src/config/config.ts:431: Add'appcontainer'toSandboxConfig['command']union - Validation —
sandboxConfig.ts:26: Add'appcontainer'toVALID_SANDBOX_COMMANDS - Detection —
sandboxConfig.ts:77: Addos.platform() === 'win32'branch - Dispatch —
sandbox.ts:51: Addif (config.command === 'appcontainer')with launch logic - Native addon — New C++ Node-API addon calling Win32 APIs (
CreateAppContainerProfile,CreateProcessWwithSECURITY_CAPABILITIES,SetNamedSecurityInfofor ACL grants)
Seatbelt Parity
| Seatbelt Feature | AppContainer Equivalent |
|---|---|
(deny default) / Low IL |
Implicit — AppContainer tokens denied by default |
(allow file-write* (subpath TARGET_DIR)) |
ACL grant: add Package SID to DACL of allowed paths |
(allow network-outbound) |
internetClient capability SID (S-1-15-3-1) |
| Proxied network (localhost:8877 only) | Loopback exemption via NetworkIsolationSetAppContainerConfig |
| Profile tiers (permissive/restrictive/strict) | Standard AppContainer / LPAC for strict read-restriction |
Why AppContainer over Windows Sandbox
- AppContainer: process-level isolation, zero overhead, all Windows editions, full Win32 API
- Windows Sandbox: full Hyper-V VM, Pro/Enterprise only, no programmatic API, seconds to boot
Working Proof of Concept
I have a working Node-API addon demonstrating the full flow:
- AppContainer profile creation + filesystem ACL gating
- WFP network filtering (block-all default + per-endpoint allow rules)
- Process launch with restricted token
Repo: https://github.com/AnushkaPandit-21/appcontainer-node-sandbox
Related
- GSoC 2026 Idea Run
npm run format#8: Native Windows Sandbox using AppContainer - PR feat(sandbox): add experimental LXC container sandbox support #20735 (LXC sandbox — merged, used as integration template)
Activity
AnushkaPandit-21 commentedon Mar 1, 2026
/assign
gemini-cli commentedon Mar 1, 2026
👋 @AnushkaPandit-21, thanks for your interest in this issue! We're reserving self-assignment for issues that have been marked with the
help wantedlabel. Feel free to check out our list of issues that need attention.AnushkaPandit-21 commentedon Mar 6, 2026
I've updated the issue description with a detailed integration plan following the same pattern as the LXC sandbox PR (#20735). I have a working PoC demonstrating AppContainer process isolation + WFP network filtering: https://github.com/AnushkaPandit-21/appcontainer-node-sandbox
Could this be triaged? I'd like to start working on the implementation.
scidomino commentedon Mar 6, 2026
@AnushkaPandit-21 Please do not ping individual maintainers on your bugs. We have a triage process. Pinging individual maintainers is not scalable.
gemini-cli commentedon May 5, 2026
This item has been automatically marked as stale due to 60 days of inactivity. It will be closed in 14 days if no further activity occurs. Thank you!
gemini-cli commentedon May 9, 2026
Feature request for Windows sandbox support.
Effort Analysis:
Adding Windows AppContainer support involves creating a native C++ Node-API addon calling Win32 APIs (
CreateAppContainerProfile, etc.) and integrating it into the sandbox configuration. Platform-specific complexities with OS-level execution and security APIs make this effort/large.gemini-cli commentedon May 13, 2026
Assigned area/platform based on content. Assigned kind/enhancement. Assigned priority/p3 based on severity. Requested more information because the CLI version is missing.
cocosheng-g commentedon May 15, 2026
This issue has been inactive for quite some time, so we are closing it as part of our routine backlog maintenance. If this is still affecting you on the latest version, please feel free to comment or open a new issue. Thanks!