DNM - #1

Summary

This PR adds three new lightweight sandbox backends — bubblewrap (bwrap), Landlock, and macOS Container — alongside the existing Docker, Podman, and sandbox-exec backends. It also adds seccomp syscall filtering as a
defense-in-depth layer for the Linux backends, and introduces comprehensive CI testing across Linux, macOS, and WSL2.

New sandbox backends

• Bubblewrap (bwrap): Linux namespace-based sandboxing using selective bind mounts. Three profiles (permissive/restrictive/strict) with -proxied variants. Handles non-standard node paths (e.g. GitHub Actions
  /opt/hostedtoolcache), WSL path warnings, and integrates seccomp via fd passing.
• Landlock: Linux kernel LSM (5.13+) for filesystem access control. Includes a statically-compiled Rust helper using N-API for Rust and Rust support for landlock that detects Landlock ABI version at runtime, applies filesystem
  rules, loads a seccomp BPF filter, then exec's the target command. Cross-compiled for amd64/arm64 and bundled with the npm package.
• macOS Container: Apple's Container Framework (macOS 15+, Apple Silicon). Runs a Linux VM with automatic Rosetta 2 integration for x86_64 images. Reuses the same container images as Docker/Podman. Unfortunately due to nested virtualization, this can't be tested on GitHub Actions :(

Seccomp syscall filtering

Shared BPF filter generation (bwrap-seccomp.ts) blocking 26 syscalls across x86_64 and aarch64: ptrace, kernel modules, keyctl, personality, namespace ops (setns/unshare), mount/umount, pivot_root, chroot, reboot, clock
manipulation, bpf, userfaultfd. clone3 returns ENOSYS (not EPERM) to trigger glibc fallback to clone(). Delivered via fd for bwrap, via temp file for landlock.

Integration tests check that some of these -- the easiest ones to test -- are successfully blocked.

Sandbox detection & routing

• Auto-detection priority on Linux: landlock > bwrap > docker > podman
• Container environment detection: Docker, Podman, Kubernetes, systemd-nspawn, cgroup-based fallback
• WSL1 vs WSL2 differentiation (WSL1 treated as container, WSL2 supports bwrap/landlock)
• Nested container detection: auto-skips sandboxing inside external containers unless GEMINI_SANDBOX=force

CI

• New test-sandbox.yml workflow with matrix testing: bwrap (ubuntu), landlock (ubuntu + arm), sandbox-exec (macOS), docker (ubuntu), bwrap-on-WSL2 (windows-2025)
• Integration test (sandbox-verification.test.ts) verifying allowed ops, filesystem restrictions, container isolation, and seccomp enforcement
• Updates to test-rig.ts to better handle parsing of telemetry on Windows
• Telemetry-based metrics reporting to GitHub step summary -- room to improve this in the future to gather better performance metrics across sandbox implementations.

Build & packaging

• Rust N-API module (@google/gemini-cli-landlock) for landlock filesystem rules and seccomp loading
• Multi-arch sandbox image support, to better support users running on Arm
• build_package.js and copy_bundle_assets.js for bundling native .node binaries
• Updated build_sandbox.js with macOS Container support

Configuration & docs

• New sandbox types in SandboxConfig: bwrap, landlock, macos-container
• Updated settings schema and validation
• Sandbox comparison table and per-backend documentation in docs/cli/sandbox.md