Vercel Sandbox SDK v3 defaults to vercel/sandbox/universal:latest — a prebuilt image that ships with Node.js LTS, Python 3.14, coding agents, and standard utilities. The old Sandbox runtimes are deprecated.
What changed:
- Managed images replace runtimes — Vercel Managed Images (VMI) are versioned, open-source base images you use as-is or extend; Sandbox runtimes are now deprecated
- OS switch — default moves from Amazon Linux to Ubuntu, lighter and more widely used across the industry
- Pre-baked stack — Node.js, Python, common coding agents, and standard utilities included, so most users skip custom image builds and package installs at boot
- Nightly releases — rolling tags (
latest) and major-version tags auto-pick-up OS updates, security patches, and new Node releases - Open source — every image’s source lives in the public
vercel/sandboxGitHub repo
The practical shift: if you were building custom Sandbox images or installing packages at boot, the universal image likely covers you now. It runs inside the same Firecracker microVM isolation Vercel Sandbox already uses — code stays blocked from your environment variables, database connections, and cloud resources.
NOTE
The default switch happens at SDK v3. If you’re on v2, your sandboxes still use the old Amazon Linux runtime until you upgrade.
Rolling tags mean you get security patches automatically — but if you pin to a specific version tag, you’re responsible for bumping it. Available now in the vercel/sandbox SDK v3.