SECURITY Signal 463
Vercel Sandbox now runs on Vercel Managed Images
↗
Vercel replaced Sandbox runtimes with Vercel Managed Images, a set of versioned, open-source base images that default to Ubuntu and receive nightly security updates.
Teams using Vercel Sandbox must plan a migration from the deprecated runtime property to the new image property, and those relying on Amazon Linux will need to decide whether to stay on the deprecated runtime or adapt to Ubuntu. The shift to managed images with automatic nightly patches reduces the operational burden of keeping sandbox environments secure, but digest-pinning for reproducibility requires explicitly opting out of those updates.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Sandbox runtimes are deprecated in favor of Vercel Managed Images, though the runtime property still works for existing code.
The default OS shifts from Amazon Linux to Ubuntu 26.04, with a universal image that bundles Node.js, Python, coding agents, and common utilities.
Nightly releases automatically push OS and dependency security patches to rolling tags, while digest-pinned images remain immutable.
THE CLUSTER