Honor the author image option on vercel() so deny-all sandboxes can boot a prebuilt VCR image

[cfleissner-evisions]

What problem are you trying to solve?

A production agent must run OCR in a Vercel sandbox. The sandbox must use networkPolicy: "deny-all" on the vercel() factory.

Eve documentation says: put a security-critical network policy on the factory. Do not put that policy only in onSession. A replacement sandbox does not run onSession again.

When the factory uses deny-all, bootstrap cannot download packages. The sandbox must start from an image that already contains the packages.

This agent needs Tesseract, Poppler, CPython 3.14, and hashed Python wheels. These packages are in a project-scoped Vercel Container Registry (VCR) image.

docker({ image }) and microsandbox({ image }) accept a custom image. vercel() TypeScript types also include image. The Vercel create binding does not use that value.

createVercelEveImageSandbox always sets image to vercel/eve:latest. The function discards the author image with no error.

This behavior is in eve 0.39.1. This behavior is also on current main (packages/eve/src/execution/sandbox/bindings/vercel-create-sdk.ts).

Related closed issue: #239. That issue removed runtime. That change did not add a replacement for a custom VCR image.

Proposed solution

Honor the author image on vercel(). If the author does not set image, use vercel/eve:latest.

Example:

import { defineSandbox } from "eve/sandbox";
import { vercel } from "eve/sandbox/vercel";

export default defineSandbox({
  backend: vercel({
    image: "ocr:1",
    networkPolicy: "deny-all",
  }),
  revalidationKey: () => "ocr:1",
});

A one-line change in createVercelEveImageSandbox:

image: image ?? VERCEL_EVE_SANDBOX_IMAGE,

This matches docker({ image }) and microsandbox({ image }).

Vercel Sandbox already accepts a VCR image on Sandbox.create({ image }). See https://vercel.com/docs/sandbox/concepts/images