Running Gemini CLI (relatively) safely in a sandbox and without npm

[crodjer]

I don't run node packages / npm on my computer, but I wanted to find a way to run gemini-cli. I found a way to do that using deno and firejail.
Basically, all you need to do is download gemini.js from github releases and then run it with deno gemini.js while sandboxing it under firejail:

DENO_COMPAT=1 firejail --whitelist=~/.gemini --whitelist=$PWD \
    $(which deno) \
    --allow-env --allow-sys --allow-read --allow-write --allow-run \
    ~/.gemini/gemini.js

Documented it on my blog.

[vhbui02]

@crodjer How reliable is this workaround may I ask? Have you experienced any breakage?

[crodjer]

@vhbui02 It does work, I moved to bwrap though.
But I maybe only use it for 1/2 prompts a week with my Pro account.

Its always a hit or a miss though, they break the release more often than not (recently moved to a zip instead of much better plain JS). Best bet is to run it in a throw away VM with a docker container if you want some piece of mind.