Vagrant After HCP Vagrant: Host Your Own Boxes

HashiCorp is shutting down HCP Vagrant, the hosted registry behind short box names such as bento/ubuntu-24.04. New boxes could not be created there after 1 October 2026, support ended on 2 November 2026, and every remaining deployment is decommissioned on 31 December 2026. The Vagrant command-line tool itself is not affected. The short answer for a sysadmin or DevOps team: recover the .box files you rely on, put them on any HTTPS server, S3 bucket or Gitea/Forgejo instance together with a small catalog JSON, and point config.vm.box_url at it. The facts below were checked against HashiCorp’s announcement, the HCP documentation and the Vagrant docs on 4 November 2026. Not tested yet: we have not migrated a registry ourselves, so there are no timing, size or cost claims here.

What is closing and when

The dates come from HashiCorp’s blog post of 17 September 2026 and the HCP deprecation page. The post is explicit about the tool: “The Vagrant CLI and source repository on GitHub will remain available”, and about hosting: customers “must move their Vagrant boxes to another hosting provider and assume the associated hosting costs.”

Two measured facts from 4 November 2026. The public registry still answers: the metadata endpoint for bento/ubuntu-24.04 returned an active version, 202510.26.0. And HashiCorp promised an export option and “a static archive that uses URL redirects during the transition”; today the Vagrant docs carry migration guides for Amazon S3, Azure Blob Storage and IBM Cloud Object Storage, but no static archive instructions. Plan as if public short names stop working on 1 January 2027. Vagrant itself is still at 2.4.9 (21 August 2025) according to HashiCorp’s releases API, free to use under the Business Source License 1.1.

What a self-hosted box registry needs

According to the Box Repository documentation, a repository has two parts: the .box files (a tar archive with the VM artefacts and a metadata.json naming the provider) and an optional catalog JSON listing the box name, versions, providers, architectures, download URLs and checksums. Without the catalog a box can still be added straight from a URL, but versioning and vagrant box update do not work. The catalog is plain JSON you can write by hand:

{
  "name": "lab/ubuntu-24.04",
  "description": "Ubuntu 24.04 base box for the lab",
  "versions": [
    {
      "version": "1.0.0",
      "providers": [
        {
          "name": "virtualbox",
          "url": "https://boxes.example.internal/lab/ubuntu-24.04/1.0.0/virtualbox-amd64.box",
          "checksum_type": "sha256",
          "checksum": "PUT-THE-SHA256-HERE",
          "architecture": "amd64",
          "default_architecture": true
        }
      ]
    }
  ]
}

Box versions must be X.Y.Z with integers only. One JSON file can describe several versions, providers and architectures, and Vagrant asks which provider to use when more than one matches.

Step 1: get the .box files back

1. Boxes already installed on a workstation. Vagrant unpacks a box when you add it and does not keep the original file. Run vagrant box list, then vagrant box repackage bento/ubuntu-24.04 virtualbox 202510.26.0; the command writes package.box into the current directory.
2. Boxes still on the registry. While it runs, download each version, provider and architecture from the box page, or ask the API for the download URL as HashiCorp’s S3 migration guide shows: curl "https://api.cloud.hashicorp.com/vagrant/2022-09-30/registry/REGISTRY/box/BOX/version/VERSION/provider/PROVIDER/architecture/ARCH/download" returns a url field; private boxes need an HCP access token.
3. VMs you prepared yourself. vagrant package --output lab-ubuntu-24.04.box packages the running environment. The docs cover VirtualBox and Hyper-V; other providers work only if the provider implements packaging. --base NAME packages a VM that VirtualBox manages outside Vagrant, and --vagrantfile embeds default settings in the box.
4. Record a checksum for every file, for example sha256sum lab-ubuntu-24.04.box, and put it in the catalog. Vagrant verifies catalog checksums on download.

Step 2: choose where to host

Publishing to Gitea or Forgejo

Both forges ship a Vagrant package registry with the same API, documented for Gitea and Forgejo. Upload is a single request per box file:

curl --user USER:TOKEN --upload-file lab-ubuntu-24.04.box 
  https://git.example.internal/api/packages/lab/vagrant/ubuntu-24.04/1.0.0/virtualbox.box

A 201 Created response means the box is published. The same name, version and provider cannot be overwritten; delete the package first. Users then run vagrant box add "https://git.example.internal/api/packages/lab/vagrant/ubuntu-24.04". If you are choosing between the two forges, see our Gitea vs Forgejo vs GitLab CE comparison.

Step 3: point the Vagrantfile at the new home

Vagrant.configure("2") do |config|
  config.vm.box         = "lab/ubuntu-24.04"
  config.vm.box_url     = "https://boxes.example.internal/lab/ubuntu-24.04.json"
  config.vm.box_version = "~> 1.0"
end

Per the config.vm reference, box_url may point at the catalog JSON (versioning on) or at a .box file (versioning off), and it accepts an array of URLs tried in order. For a direct file, add config.vm.box_download_checksum and config.vm.box_download_checksum_type (md5, sha1, sha256, sha384 or sha512), because Vagrant checks nothing otherwise. The default box_check_update = true only does something for versioned boxes. ~> 1.0 means at least 1.0 and below 2.0.

Keep building boxes with Packer

The Vagrant docs recommend Packer for reproducible base boxes. The Packer Vagrant post-processor converts builds from VirtualBox, Hyper-V, VMware, QEMU, Docker, Parallels, LXC and several cloud builders into .box files. The bento project by Progress Chef, which publishes bento/ubuntu-24.04, keeps its Packer templates on GitHub under the Apache-2.0 licence; the README asks for Packer 1.7 or later, Vagrant 2.4.0 or later and VirtualBox, VMware Workstation or Fusion, Parallels or UTM, with QEMU and Hyper-V marked experimental. A team that depends on a bento box can therefore build the same box on its own hardware and publish it to its own catalog. The vagrant-cloud and vagrant-registry post-processors upload to HCP Vagrant and will have nowhere to upload after the shutdown. If you build with QEMU or VMware Workstation Pro, use the matching provider name in the catalog.

Who should do this, and who should not

• Do it if Vagrantfiles live in your Git repositories, CI pipelines or onboarding guides, if you test Ansible roles on throwaway VMs, or if an MSP team shares standard lab images. Public boxes survive only where the publisher rehosts them; a private catalog removes that dependency.
• Skip it if you start one or two VMs by hand now and then: a desktop hypervisor is enough, see what replaced VMware Workstation Player. Long-lived lab servers belong on Proxmox VE with templates; application stacks usually fit containers better.

More hypervisors and container tools are in the virtualization and container tools hub; CI servers and Infrastructure as Code tools are in the DevOps automation tools hub.

Limitations

Not tested yet: we have not run a migration, uploaded to Gitea or S3, or rebuilt a bento box ourselves; every command above comes from the official documentation as of 4 November 2026. HashiCorp may still publish the static archive or move dates, so check the deprecation page before you cut over. Box images carry the licence of the operating system inside them; respecting it when you mirror them is on you.

FAQ

What happens to boxes hosted on the HCP Vagrant registry?

They remain downloadable until HashiCorp decommissions the deployments on 31 December 2026; nothing new can be published since 1 October 2026. Download or repackage what you need before the end of the year.

How do I add a Vagrant box from a local file?

Run vagrant box add --name lab/ubuntu-24.04 ./lab-ubuntu-24.04.box. A direct file needs --name and has no versioning; pass a local catalog JSON instead if you want versions.

How do I add a specific version of a box?

Use vagrant box add --box-version 1.0.0 https://boxes.example.internal/lab/ubuntu-24.04.json, or set config.vm.box_version in the Vagrantfile. This only works with a catalog.

Does vagrant package work with VMware?

The documentation describes vagrant package for VirtualBox and Hyper-V and says other providers are supported only if the provider implements it. For VMware and QEMU, Packer with its Vagrant post-processor is the documented route.

Where do I get an Ubuntu 24.04 box after the shutdown?

From wherever the publisher rehosts it, or by building it from the bento Packer templates on GitHub and publishing it to your own catalog.

Is there a Vagrant box registry I can self-host?

Yes. Gitea and Forgejo include one, and any web server that serves the .box files plus a catalog JSON is a valid repository as far as Vagrant is concerned.

Last updated: 4 November 2026 · ITForgePro editorial team. Licence, version and platform details are checked against each developer's official documentation.