From cc89830b2ab74ec8d4a04e5846c7d3a08bb6d31b Mon Sep 17 00:00:00 2001
From: Brandon Keiji <brandonkeiji@google.com>
Date: Wed, 18 Jun 2025 12:43:12 -0700
Subject: [PATCH] refactor: consolidate container image tag source of truth to
 cli package.json (#1156)

---
 packages/cli/src/config/sandboxConfig.ts | 19 +++++++------------
 scripts/build_sandbox.js                 | 17 ++++++++++++-----
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/packages/cli/src/config/sandboxConfig.ts b/packages/cli/src/config/sandboxConfig.ts
index 69a54900..5a86aed0 100644
--- a/packages/cli/src/config/sandboxConfig.ts
+++ b/packages/cli/src/config/sandboxConfig.ts
@@ -85,18 +85,13 @@ export async function loadSandboxConfig(
   argv: SandboxCliArgs,
 ): Promise<SandboxConfig | undefined> {
   const sandboxOption = argv.sandbox ?? settings.sandbox;
-  const sandboxCommand = getSandboxCommand(sandboxOption);
-  if (!sandboxCommand) {
-    return undefined;
-  }
+  const command = getSandboxCommand(sandboxOption);
 
   const packageJson = await getPackageJson();
-  return {
-    command: sandboxCommand,
-    image:
-      argv['sandbox-image'] ??
-      process.env.GEMINI_SANDBOX_IMAGE ??
-      packageJson?.config?.sandboxImageUri ??
-      'gemini-cli-sandbox',
-  };
+  const image =
+    argv['sandbox-image'] ??
+    process.env.GEMINI_SANDBOX_IMAGE ??
+    packageJson?.config?.sandboxImageUri;
+
+  return command && image ? { command, image } : undefined;
 }
diff --git a/scripts/build_sandbox.js b/scripts/build_sandbox.js
index c6a16c23..941fa7f6 100644
--- a/scripts/build_sandbox.js
+++ b/scripts/build_sandbox.js
@@ -22,6 +22,7 @@ import { chmodSync, readFileSync, rmSync } from 'fs';
 import { join } from 'path';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
+import cliPkgJson from '../packages/cli/package.json' with { type: 'json' };
 
 const argv = yargs(hideBin(process.argv))
   .option('s', {
@@ -47,9 +48,7 @@ try {
     .toString()
     .trim();
 } catch {
-  console.warn(
-    'WARNING: container-based sandboxing is disabled (see README.md#sandboxing)',
-  );
+  console.warn('ERROR: could not detect sandbox container command');
   process.exit(0);
 }
 
@@ -62,11 +61,17 @@ if (sandboxCommand === 'sandbox-exec') {
 
 console.log(`using ${sandboxCommand} for sandboxing`);
 
-const baseImage = 'gemini-cli-sandbox';
+const baseImage = cliPkgJson.config.sandboxImageUri;
 const customImage = argv.i;
 const baseDockerfile = 'Dockerfile';
 const customDockerfile = argv.f;
 
+if (!baseImage?.length) {
+  console.warn(
+    'No default image tag specified in gemini-cli/packages/cli/package.json',
+  );
+}
+
 if (!argv.s) {
   execSync('npm install', { stdio: 'inherit' });
   execSync('npm run build --workspaces', { stdio: 'inherit' });
@@ -122,7 +127,9 @@ function buildImage(imageName, dockerfile) {
   console.log(`built ${imageName}`);
 }
 
-buildImage(baseImage, baseDockerfile);
+if (baseImage && baseDockerfile) {
+  buildImage(baseImage, baseDockerfile);
+}
 
 if (customDockerfile && customImage) {
   buildImage(customImage, customDockerfile);