Push images to Vercel Container Registry from GitHub Actions, Vercel changelog, 25 Sep 2026

You can now push container images from GitHub Actions to Vercel Container Registry (VCR) without storing long-lived registry credentials.

The new vercel/vcr-action/login action authenticates your workflow using GitHub OIDC. It exchanges the workflow’s OIDC token for a short-lived Vercel access token, then uses that token to log in to vcr.vercel.com. When the job ends, the action logs out and revokes the Vercel token.

To start:

Create an OIDC policy on your Vercel team that matches the GitHub repository and workflow, and grants read-write access to VCR.
Store your Vercel team ID as a GitHub repo variable, for example VERCEL_TEAM_ID, along with the team slug, project slug, and repo name used in the image tag.
Give the workflow or job id-token: write permission.

Then add the login step before you build and push and the image:

The action authenticates Docker by default. Pass engines to use Podman or Buildah instead.

After VCR finishes preparing a linux/amd64 image, you can use it as a custom Vercel Sandbox image. Within the same project, reference it as <repository>:<tag>.

Learn more in the VCR documentation and the GitHub Actions guide.