[images]: Add runtime images

images/README.md

@@ -10,6 +10,9 @@ Dockerfiles for Vercel Managed Images published to Vercel Container Registry (VC
 | [`vercel/sandbox/python:3.14`](./python)         | `vercel/sandbox/ubuntu` | Python 3.14 (pinned), pip, venv, uv                       |
 | [`vercel/sandbox/arch:latest`](./arch)           | `archlinux:latest`      | Arch Linux, yay (AUR), base-devel, git                    |
 | [`vercel/sandbox/ubuntu:latest`](./ubuntu)       | `ubuntu:26.04`          | Ubuntu + sudo                                             |
+| [`vercel/sandbox/runtime-base:latest`](./runtime-base) | `amazonlinux:2023` | Amazon Linux runtime base, Git 2.49.0, sudo               |
+| [`vercel/sandbox/runtime-node:22\|24\|26`](./runtime-node) | `runtime-base` | Node.js runtime (major pinned), pnpm                      |
+| [`vercel/sandbox/runtime-python:3.13.1`](./runtime-python) | `runtime-base` | Python 3.13.1, pip, venv, uv                              |
 
 All images are built for `linux/amd64`.
 

images/docker-bake.hcl

@@ -3,7 +3,7 @@ variable "REGISTRY" {
 }
 
 group "default" {
-  targets = ["ubuntu", "node", "python", "universal", "arch"]
+  targets = ["ubuntu", "node", "python", "universal", "arch", "runtime-node", "runtime-python"]
 }
 
 target "_common" {
@@ -88,3 +88,75 @@ target "arch" {
   context  = "arch"
   tags     = ["${REGISTRY}/arch:latest"]
 }
+
+target "runtime-builder-base" {
+  inherits   = ["_common"]
+  context    = "runtime-base"
+  dockerfile = "Dockerfile"
+  target     = "builder-base"
+}
+
+target "runtime-base" {
+  inherits   = ["_common"]
+  context    = "runtime-base"
+  dockerfile = "Dockerfile"
+  target     = "sandbox-base"
+
+  contexts = {
+    src = "."
+  }
+}
+
+target "runtime-node" {
+  matrix = {
+    node = [
+      {
+        major   = "22"
+        version = "22.22.2"
+      },
+      {
+        major   = "24"
+        version = "24.14.1"
+      },
+      {
+        major   = "26"
+        version = "26.1.0"
+      },
+    ]
+  }
+
+  name       = "runtime-node-${node.major}"
+  inherits   = ["_common"]
+  context    = "runtime-node"
+  dockerfile = "Dockerfile"
+  tags = [
+    "${REGISTRY}/node:al-${node.major}",
+    "${REGISTRY}/node:al-${node.version}",
+  ]
+
+  contexts = {
+    sandbox-base = "target:runtime-base"
+  }
+
+  args = {
+    NODE_ARCH    = "x64"
+    NODE_MAJOR   = node.major
+    NODE_VERSION = node.version
+  }
+}
+
+target "runtime-python" {
+  inherits   = ["_common"]
+  context    = "runtime-python"
+  dockerfile = "Dockerfile"
+  tags       = ["${REGISTRY}/python:al-3.13.1"]
+
+  contexts = {
+    builder-base = "target:runtime-builder-base"
+    sandbox-base = "target:runtime-base"
+  }
+
+  args = {
+    PYTHON_VERSION = "3.13.1"
+  }
+}

images/runtime-base/CHANGELOG.md

@@ -0,0 +1,7 @@
+# sandbox-image-runtime-base
+
+## 0.1.0
+
+### Minor Changes
+
+- Initial release of the Amazon Linux runtime base image.

images/runtime-base/Dockerfile

@@ -0,0 +1,95 @@
+FROM amazonlinux:2023 AS builder-base
+
+WORKDIR /sandbox
+
+RUN dnf update -y && \
+    echo "install_weak_deps=False" >> /etc/dnf/dnf.conf && \
+    dnf install -y \
+        bind-utils \
+        bzip2 \
+        findutils \
+        gcc \
+        git \
+        gzip \
+        iputils \
+        libicu \
+        libjpeg \
+        libpng \
+        make \
+        ncurses-libs \
+        openssl \
+        openssl-libs \
+        openssl-devel \
+        procps \
+        tar \
+        unzip \
+        wget \
+        which \
+        whois \
+        xz-devel \
+        zlib-devel \
+        zstd \
+        curl-devel \
+        expat-devel \
+        gettext-devel \
+        perl-devel \
+        autoconf \
+        libffi-devel && \
+    dnf clean all && \
+    rm -rf /var/cache/yum /var/lib/rpm/__db.*
+
+FROM builder-base AS builder-git
+
+# Compile git 2.49.0 from source to /opt/git
+RUN cd /tmp && \
+    curl -L https://github.com/git/git/archive/v2.49.0.tar.gz | tar -zx && \
+    cd git-2.49.0 && \
+    make configure && \
+    ./configure --prefix=/opt/git && \
+    make all && \
+    make install && \
+    cd / && rm -rf /tmp/git-2.49.0
+
+FROM amazonlinux:2023 AS sandbox-base
+
+RUN dnf update -y && \
+    echo "install_weak_deps=False" >> /etc/dnf/dnf.conf && \
+    dnf install -y \
+        bind-utils \
+        bzip2 \
+        findutils \
+        git \
+        gzip \
+        iputils \
+        libatomic \
+        libicu \
+        libjpeg \
+        libpng \
+        ncurses-libs \
+        openssl \
+        openssl-libs \
+        procps \
+        sudo \
+        tar \
+        unzip \
+        which \
+        whois \
+        zstd \
+        iptables-legacy && \
+    dnf clean all && \
+    rm -rf /var/cache/yum /var/lib/rpm/__db.* && \
+    alternatives --set iptables /usr/sbin/iptables-legacy
+
+COPY --from=builder-git /opt/git /opt/git
+
+COPY --from=src ./git-credential-helper.sh /vercel/bin/git-credential-helper
+
+# Note: Installing package manager git for dependencies, but PATH prioritizes our compiled git 2.49.0
+ENV PATH="/vercel/bin:/opt/git/bin:/home/vercel-sandbox/.local/bin:/usr/local/bin:${PATH}"
+
+COPY --from=src ./sudoers /etc/sudoers
+
+RUN groupadd -g 1000 vercel-sandbox && \
+    useradd -m -u 1000 -g vercel-sandbox -s /bin/bash vercel-sandbox && \
+    mkdir /vercel/sandbox && \
+    chown vercel-sandbox:vercel-sandbox /vercel/sandbox

images/runtime-base/README.md

@@ -0,0 +1,15 @@
+# runtime-base
+
+`vercel/sandbox/runtime-base:latest`
+
+The Amazon Linux 2023 base image for the runtime image family. It includes a
+compiled Git 2.49.0 installation and common runtime utilities.
+
+Runs as the `vercel-sandbox` user (uid 1000) with passwordless sudo.
+
+## Packages
+
+- Git 2.49.0
+- Common network, archive, process and image libraries
+- `sudo`
+- Legacy iptables

images/runtime-base/git-credential-helper.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+echo "username=$GIT_USERNAME"
+echo "password=$GIT_PASSWORD"

images/runtime-base/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "sandbox-image-runtime-base",
+  "version": "0.1.0",
+  "private": true
+}

images/runtime-base/sudoers

@@ -0,0 +1,30 @@
+# Set `HOME` to `/root` when executing commands as `sudo`. This
+# means that configuration files from `root` will be picked up
+# instead of the users configuration files. This is consistent
+# with a lot of other Linux distributions.
+Defaults    always_set_home
+
+# Improve performance of any group lookups, if any.
+Defaults    match_group_by_gid
+
+# Disable environment variable reset for most varriables. This
+# allows us to have intuitive semantics when users run:
+#
+#   runCommand({
+#     cmd: "some-command",
+#     sudo: true,
+#     env: {
+#       SOME_VAR: "value"
+#     },
+#   })
+#
+# Note: we do not set the `secure_path` option, meaning we allow users
+# to customize their paths. That fixes a common papercut with `sudo` usage
+# and is no different than allowing `sudo ./some-local-binary` or invoking
+# commands with an absolute path.
+Defaults    !env_reset
+
+# Allow `root` and `vercel-sandbox` to run all commands without specifying
+# a password. (As any user).
+root           ALL=(ALL) NOPASSWD:ALL
+vercel-sandbox ALL=(ALL) NOPASSWD:ALL

images/runtime-node/CHANGELOG.md

@@ -0,0 +1,7 @@
+# sandbox-image-runtime-node
+
+## 0.1.0
+
+### Minor Changes
+
+- Initial release of the Amazon Linux Node.js runtime images.

images/runtime-node/Dockerfile

@@ -0,0 +1,19 @@
+FROM sandbox-base AS sandbox-node
+
+ARG NODE_ARCH=x64
+ARG NODE_MAJOR
+ARG NODE_VERSION
+
+RUN mkdir -p /vercel/runtimes/node${NODE_MAJOR} && curl https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-$NODE_ARCH.tar.gz | tar -zx --strip-components=1 -C /vercel/runtimes/node${NODE_MAJOR} && /vercel/runtimes/node${NODE_MAJOR}/bin/node --version
+ENV PATH="/vercel/runtimes/node${NODE_MAJOR}/bin:${PATH}"
+
+RUN npm install -g pnpm@10
+
+USER vercel-sandbox
+
+RUN mkdir -p ~/.global/{npm,pnpm} && \
+  npm config set prefix ~/.global/npm && \
+  pnpm config set global-dir ~/.global/pnpm && \
+  pnpm config set global-bin-dir ~/.global/pnpm/bin
+
+ENV PATH="/vercel/runtimes/node${NODE_MAJOR}/bin:/home/vercel-sandbox/.global/pnpm/bin:/home/vercel-sandbox/.global/npm/bin:${PATH}"

images/runtime-node/README.md

@@ -0,0 +1,16 @@
+# runtime-node
+
+`vercel/sandbox/runtime-node:22` | `vercel/sandbox/runtime-node:24` | `vercel/sandbox/runtime-node:26`
+
+Node.js on top of the [runtime-base](../runtime-base) image. Each tag pins a
+major version, with the exact release supplied to the build through
+`NODE_VERSION`.
+
+Runs as the `vercel-sandbox` user (uid 1000) with passwordless sudo.
+
+## Packages
+
+- Node.js 22.22.2, 24.14.1, or 26.1.0 (depending on the image tag)
+- `npm` and `npx`
+- `pnpm` 10
+- Git 2.49.0

images/runtime-node/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "sandbox-image-runtime-node",
+  "version": "0.1.0",
+  "private": true
+}

images/runtime-python/CHANGELOG.md

@@ -0,0 +1,7 @@
+# sandbox-image-runtime-python
+
+## 0.1.0
+
+### Minor Changes
+
+- Initial release of the Amazon Linux Python runtime image.

images/runtime-python/Dockerfile

@@ -0,0 +1,45 @@
+FROM builder-base AS builder-python
+
+ARG PYTHON_VERSION=3.13.1
+
+RUN mkdir -p /vercel/runtimes/python && \
+    wget "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tgz" && \
+    tar -xvf "Python-$PYTHON_VERSION.tgz" && \
+    cd "Python-$PYTHON_VERSION" && \
+    ./configure --enable-optimizations --prefix=/vercel/runtimes/python && \
+    make -j $NUM_CORES && \
+    make install && \
+    cd .. && \
+    rm -rf "Python-$PYTHON_VERSION" "Python-$PYTHON_VERSION.tgz"
+
+ENV PATH="/opt/git/bin:/vercel/runtimes/python/bin:/home/vercel-sandbox/.local/bin:/usr/local/bin:${PATH}"
+
+RUN python3 -m pip install --upgrade pip && \
+    pip install uv
+
+RUN rm -rf \
+  /vercel/runtimes/python/lib/python3.13/test \
+  /vercel/runtimes/python/lib/python3.13/__pycache__ \
+  /vercel/runtimes/python/lib/python3.13/ensurepip \
+  /vercel/runtimes/python/lib/python3.13/idlelib \
+  /vercel/runtimes/python/lib/python3.13/tkinter \
+  /vercel/runtimes/python/lib/python3.13/distutils \
+  /vercel/runtimes/python/lib/pkgconfig \
+  /vercel/runtimes/python/share
+
+# Convenience symlink so `python`, `python3` and `python3.13` all work.
+RUN ln --relative --symbolic /vercel/runtimes/python/bin/python3 /vercel/runtimes/python/bin/python
+
+FROM sandbox-base AS sandbox-python
+
+# Copy compiled Python and git from builder stage
+COPY --from=builder-python /vercel/runtimes/python /vercel/runtimes/python
+
+ENV PATH="/vercel/runtimes/python/bin:${PATH}"
+
+USER vercel-sandbox
+
+RUN python3 --version && \
+    pip3 --version && \
+    python3 -m venv -h && \
+    uv --version

images/runtime-python/README.md

@@ -0,0 +1,15 @@
+# runtime-python
+
+`vercel/sandbox/runtime-python:3.13.1`
+
+Python on top of the [runtime-base](../runtime-base) image. Python 3.13.1 is
+compiled from source and installed under `/vercel/runtimes/python`.
+
+Runs as the `vercel-sandbox` user (uid 1000) with passwordless sudo.
+
+## Packages
+
+- Python 3.13.1
+- `pip` and `venv`
+- `uv`
+- Git 2.49.0

images/runtime-python/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "sandbox-image-runtime-python",
+  "version": "0.1.0",
+  "private": true
+}