Gemini CLI is Google’s open-source terminal AI agent. It offers a free tier with 1,000 requests per day and a 1M token context window. While its code quality trails Claude Code, it provides zero-cost access for developers. It’s now the most-starred AI coding CLI on GitHub.

The Free Tier That Drove 97K GitHub Stars

Gemini CLI has about 97K GitHub stars. This exceeds Codex CLI ’s 73K and beats Claude Code . The reason’s simple: Gemini CLI is the only major terminal agent with a real free tier.

You can switch your Linux install from X11 to Wayland without reinstalling anything. The move comes down to picking a Wayland session at your login screen. After that, three things need follow-up: Xwayland for legacy X11 apps, input setup through libinput instead of xorg.conf, and a few environment variables. Those variables let toolkits like Qt, GTK, and Electron render through Wayland instead of falling back to X11. Most people finish in an afternoon. You can keep an X11 session as a fallback until you’re happy everything works.

Hardening a Docker image means cutting the attack surface at every layer. Start from a minimal base like distroless or Alpine. Run as a non-root user. Set the filesystem read-only. Drop all Linux capabilities and add back only what the app needs. Pin dependency versions with checksums. Scan images with Trivy or Grype before you push. Each layer of this checklist stands on its own, so you can adopt them one at a time.

You implement OAuth 2.0 login by using the Authorization Code flow with PKCE (Proof Key for Code Exchange). Your web app redirects the user to the provider’s authorization endpoint with a code_challenge, the user authenticates and consents, the provider redirects back with an authorization code, and your backend exchanges that code along with the code_verifier for an access token. PKCE is mandatory for all OAuth 2.0 clients under the OAuth 2.1 draft specification (currently at draft-ietf-oauth-v2-1-15) and eliminates the need for a client secret in public clients. Building this from scratch - without Auth0, Clerk, or NextAuth - takes roughly 200 lines of code and teaches you exactly how token exchange, session management, and token refresh actually work.

If you have ever handed a new team member a README full of “install Node 22, then Python 3.12, then make sure your openssl headers match” instructions, you already know the problem. Nix flakes solve it at the root: instead of documenting what to install, you declare the exact toolchain in a flake.nix file, commit it alongside your code, and every developer runs nix develop to get an identical environment - same compiler, same CLI versions, same system libraries. In 2026, Nix flakes are stable, the Nixpkgs repository holds over 100,000 packages, and the ecosystem around flakes has matured to the point where the learning curve is manageable even for teams with no prior Nix experience.

Run Traefik v3 as a Docker container to build a production-ready stack. It discovers services through Docker labels and handles Let’s Encrypt TLS certificates automatically. You won’t need separate Nginx configs because everything lives in one docker-compose.yml file. This setup gives you a self-managing reverse proxy for multi-service deployments.

The current stable release as of early 2026 is Traefik v3.6.x, with v3.7 in early access. All examples in this guide target the v3.x line.