· ReadyStack
Worked example
Real numbers from this tool, line by line.
A DevOps or QA engineer running one old Vagrant lab gets 6 findings in 1 file: six lines in a single Vagrantfile point at an operating system past end of support, and the newest is Debian 11, whose LTS ended on 2026-08-31.
That is the measured result on the sample lab that ships with Vagrantfile EOL Box Lint. Five machines, one provision script.
What was in the file
The lab defines an API box on ubuntu/focal64, a database on centos/7 with a shell provisioner, a cache on debian/bullseye64, a legacy service on bento/debian-10.13 and a build host on freebsd/FreeBSD-13.2-RELEASE. None of these lines look wrong.
The lint reported, on 2026-09-27:
L5 ubuntu/focal64 Ubuntu 20.04 ended 2025-05-31 (484 days ago)
L16 centos/7 CentOS 7 ended 2024-06-30 (819 days ago)
L19 mirrorlist.centos.org CentOS 7 ended 2024-06-30 (819 days ago)
L24 debian/bullseye64 Debian 11 LTS ended 2026-08-31 (27 days ago)
L28 bento/debian-10.13 Debian 10 ended 2024-06-30 (819 days ago)
L32 freebsd/FreeBSD-13.2-RELEASE FreeBSD 13 ended 2026-04-30 (150 days ago)The Debian 11 line is only 27 days past its date. That box was inside support in August and outside it in September, and nothing in Vagrant says so.
Why the usual checks miss it
vagrant box outdated answers one question: is there a newer version of this box? For debian/bullseye64 the answer can be "no, you are current", which is true and still leaves you on an OS with no LTS coverage. The command has no idea what an end-of-support date is.
Chatbots have the opposite problem. They know what end of support means, but their dates stop at the training cutoff. Ask one trained before 2026-08-31 about Debian 11 and it will tell you LTS is still running.
The CentOS 7 case costs the most. The database box's provision script calls mirrorlist.centos.org, which no longer answers. Any teammate who runs vagrant destroy && vagrant up gets a failed yum step instead of a database. The lint flags that line on its own (rule centos-mirrorlist) because the box name alone does not show which provision steps will break.
How the lint decides
There are 15 rules in a plain JSON table: 14 OS releases (Ubuntu 12.04 to 20.04, Debian 8 to 11, CentOS 6, 7, 8 and Stream 8, FreeBSD 13) plus the mirrorlist line. For each config.vm.box, box: or :box => value the engine matches the release number or codename, so ubuntu/focal64, bento/ubuntu-20.04 and generic/ubuntu2004 all hit the same rule. It then counts days from today to the end-of-support date. A date in the past is an error. A date less than 180 days away is a warning.
A clean file with bento/ubuntu-24.04, almalinux/9 and debian/bookworm64 returns 0 findings.
What to do with the six lines
Every finding names a target: bento/ubuntu-24.04 for the Ubuntu boxes, almalinux/9 or rockylinux/9 for CentOS, a Debian 12 or 13 box for bullseye and buster, a FreeBSD 14 box for the build host, and vault.centos.org if you truly have to keep CentOS 7 alive for a while longer.
Free and licensed
The free check runs on one Vagrantfile, fully, in the editor or on the web page, and nothing is uploaded. If you keep a dozen labs, the licensed tier scans every Vagrantfile in the workspace at once and exports one migration report you can attach to the ticket.
Open your oldest Vagrantfile and see how many lines come back.
15 seconds — what it actually does
Questions people ask
What does Vagrantfile EOL Box Lint do?
It reads each config.vm.box line in a Vagrantfile and flags boxes whose operating system is past end of support. It has 15 rules: 14 OS releases (Ubuntu 12.04 to 20.04, Debian 8 to 11, CentOS 6, 7, 8 and Stream 8, FreeBSD 13) and the dead mirrorlist.centos.org line. Each finding gives the line, the date, the days since and the box to move to.
Who is this lint for?
DevOps, QA and platform engineers who still keep Vagrant labs for local testing, training or CI, often boxes set up years ago on CentOS 7, Ubuntu 20.04 or Debian 11. Debian 11 LTS ended on 2026-08-31, so a debian/bullseye64 lab that was fine in August stopped getting security fixes in September.
Why not use vagrant box outdated or ask a chatbot?
vagrant box outdated only reports whether a newer version of the same box exists. It never says that the OS inside the box has reached end of support. A chatbot trained before 2026-08-31 can still describe Debian 11 as supported. This lint compares each box against a dated table and counts days from today.
What is free and what needs a licence key?
The free tier checks one Vagrantfile completely: every end-of-life box and the mirrorlist.centos.org line, each with its date and the box to move to. The sample lab gives 6 findings in 1 file. A licence key adds a workspace scan of every Vagrantfile at once, plus one exported migration report for the whole lab.
What does checking this by hand cost?
By hand you open every Vagrantfile, map each box name such as generic/ubuntu2004 or bento/debian-10.13 to its OS release, then look up 14 separate vendor end-of-support pages and do the date arithmetic. The lint does that in the editor as you type, and the free check needs no account.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Vagrantfile EOL Box Lint checks the file you open against 15 rules from a rule set dated 2026-09-27, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.