diff --git a/metadata/sandbox.go b/metadata/sandbox.go
index bcdfce8a3..82cf239b0 100644
--- a/metadata/sandbox.go
+++ b/metadata/sandbox.go
@@ -28,7 +28,7 @@ import (
 	"github.com/containerd/containerd/metadata/boltutil"
 	"github.com/containerd/containerd/namespaces"
 	api "github.com/containerd/containerd/sandbox"
-	"github.com/gogo/protobuf/types"
+	"github.com/containerd/typeurl"
 	"github.com/pkg/errors"
 	"go.etcd.io/bbolt"
 )
@@ -114,7 +114,7 @@ func (s *sandboxStore) Update(ctx context.Context, sandbox api.Sandbox, fieldpat
 				continue
 			} else if strings.HasPrefix(path, "extensions.") {
 				if updated.Extensions == nil {
-					updated.Extensions = map[string]types.Any{}
+					updated.Extensions = map[string]typeurl.Any{}
 				}
 
 				key := strings.TrimPrefix(path, "extensions.")
diff --git a/metadata/sandbox_test.go b/metadata/sandbox_test.go
index 0a6d82a59..0147de780 100644
--- a/metadata/sandbox_test.go
+++ b/metadata/sandbox_test.go
@@ -21,7 +21,9 @@ import (
 	"testing"
 
 	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/protobuf"
 	api "github.com/containerd/containerd/sandbox"
+	"github.com/containerd/typeurl"
 	"github.com/gogo/protobuf/types"
 )
 
@@ -35,9 +37,9 @@ func TestSandboxCreate(t *testing.T) {
 		ID:     "1",
 		Labels: map[string]string{"a": "1", "b": "2"},
 		Spec:   &types.Any{TypeUrl: "1", Value: []byte{1, 2, 3}},
-		Extensions: map[string]types.Any{
-			"ext1": {TypeUrl: "url/1", Value: []byte{1, 2, 3}},
-			"ext2": {TypeUrl: "url/2", Value: []byte{3, 2, 1}},
+		Extensions: map[string]typeurl.Any{
+			"ext1": &types.Any{TypeUrl: "url/1", Value: []byte{1, 2, 3}},
+			"ext2": &types.Any{TypeUrl: "url/2", Value: []byte{3, 2, 1}},
 		},
 		Runtime: api.RuntimeOpts{
 			Name:    "test",
@@ -91,8 +93,8 @@ func TestSandboxUpdate(t *testing.T) {
 		ID:     "2",
 		Labels: map[string]string{"lbl1": "existing"},
 		Spec:   &types.Any{TypeUrl: "1", Value: []byte{1}}, // will replace
-		Extensions: map[string]types.Any{
-			"ext2": {TypeUrl: "url2", Value: []byte{4, 5, 6}}, // will append `ext1`
+		Extensions: map[string]typeurl.Any{
+			"ext2": &types.Any{TypeUrl: "url2", Value: []byte{4, 5, 6}}, // will append `ext1`
 		},
 		Runtime: api.RuntimeOpts{Name: "test"}, // no change
 	}); err != nil {
@@ -105,8 +107,8 @@ func TestSandboxUpdate(t *testing.T) {
 		ID:     "2",
 		Labels: map[string]string{"lbl1": "new"},
 		Spec:   &expectedSpec,
-		Extensions: map[string]types.Any{
-			"ext1": {TypeUrl: "url1", Value: []byte{1, 2}},
+		Extensions: map[string]typeurl.Any{
+			"ext1": &types.Any{TypeUrl: "url1", Value: []byte{1, 2}},
 		},
 	}, "labels.lbl1", "extensions.ext1", "spec")
 	if err != nil {
@@ -119,9 +121,9 @@ func TestSandboxUpdate(t *testing.T) {
 		Labels: map[string]string{
 			"lbl1": "new",
 		},
-		Extensions: map[string]types.Any{
-			"ext1": {TypeUrl: "url1", Value: []byte{1, 2}},
-			"ext2": {TypeUrl: "url2", Value: []byte{4, 5, 6}},
+		Extensions: map[string]typeurl.Any{
+			"ext1": &types.Any{TypeUrl: "url1", Value: []byte{1, 2}},
+			"ext2": &types.Any{TypeUrl: "url2", Value: []byte{4, 5, 6}},
 		},
 		Runtime: api.RuntimeOpts{Name: "test"},
 	}
@@ -154,14 +156,14 @@ func TestSandboxList(t *testing.T) {
 			ID:         "1",
 			Labels:     map[string]string{"test": "1"},
 			Spec:       &types.Any{TypeUrl: "1", Value: []byte{1, 2, 3}},
-			Extensions: map[string]types.Any{"ext": {}},
+			Extensions: map[string]typeurl.Any{"ext": &types.Any{}},
 			Runtime:    api.RuntimeOpts{Name: "test"},
 		},
 		{
 			ID:     "2",
 			Labels: map[string]string{"test": "2"},
 			Spec:   &types.Any{TypeUrl: "2", Value: []byte{3, 2, 1}},
-			Extensions: map[string]types.Any{"ext": {
+			Extensions: map[string]typeurl.Any{"ext": &types.Any{
 				TypeUrl: "test",
 				Value:   []byte{9},
 			}},
@@ -201,14 +203,14 @@ func TestSandboxListWithFilter(t *testing.T) {
 			ID:         "1",
 			Labels:     map[string]string{"test": "1"},
 			Spec:       &types.Any{TypeUrl: "1", Value: []byte{1, 2, 3}},
-			Extensions: map[string]types.Any{"ext": {}},
+			Extensions: map[string]typeurl.Any{"ext": &types.Any{}},
 			Runtime:    api.RuntimeOpts{Name: "test"},
 		},
 		{
 			ID:     "2",
 			Labels: map[string]string{"test": "2"},
 			Spec:   &types.Any{TypeUrl: "2", Value: []byte{3, 2, 1}},
-			Extensions: map[string]types.Any{"ext": {
+			Extensions: map[string]typeurl.Any{"ext": &types.Any{
 				TypeUrl: "test",
 				Value:   []byte{9},
 			}},
@@ -284,7 +286,7 @@ func assertEqualInstances(t *testing.T, x, y api.Sandbox) {
 		t.Fatalf("runtime names are not equal: %q != %q", x.Runtime.Name, y.Runtime.Name)
 	}
 
-	if !reflect.DeepEqual(x.Runtime.Options, y.Runtime.Options) {
+	if !reflect.DeepEqual(protobuf.FromAny(x.Runtime.Options), protobuf.FromAny(y.Runtime.Options)) {
 		t.Fatalf("runtime options are not equal: %+v != %+v", x.Runtime.Options, y.Runtime.Options)
 	}
 }
diff --git a/sandbox.go b/sandbox.go
index 1e949aac8..ef5f94d3e 100644
--- a/sandbox.go
+++ b/sandbox.go
@@ -217,7 +217,7 @@ func WithSandboxSpec(s *oci.Spec, opts ...oci.SpecOpts) NewSandboxOpts {
 func WithSandboxExtension(name string, ext interface{}) NewSandboxOpts {
 	return func(ctx context.Context, client *Client, s *api.Sandbox) error {
 		if s.Extensions == nil {
-			s.Extensions = make(map[string]types.Any)
+			s.Extensions = make(map[string]typeurl.Any)
 		}
 
 		any, err := typeurl.MarshalAny(ext)
@@ -225,7 +225,7 @@ func WithSandboxExtension(name string, ext interface{}) NewSandboxOpts {
 			return errors.Wrap(err, "failed to marshal sandbox extension")
 		}
 
-		s.Extensions[name] = *any
+		s.Extensions[name] = any
 		return err
 	}
 }
diff --git a/sandbox/helpers.go b/sandbox/helpers.go
index ad984e9e8..0ffd7bbd0 100644
--- a/sandbox/helpers.go
+++ b/sandbox/helpers.go
@@ -18,38 +18,51 @@ package sandbox
 
 import (
 	"github.com/containerd/containerd/api/types"
+	"github.com/containerd/containerd/protobuf"
+	"github.com/containerd/typeurl"
+	gogo_types "github.com/gogo/protobuf/types"
 )
 
 // ToProto will map Sandbox struct to it's protobuf definition
-func ToProto(s *Sandbox) types.Sandbox {
+func ToProto(sandbox *Sandbox) types.Sandbox {
+	extensions := make(map[string]gogo_types.Any)
+	for k, v := range sandbox.Extensions {
+		extensions[k] = *protobuf.FromAny(v)
+	}
 	return types.Sandbox{
-		SandboxID: s.ID,
+		SandboxID: sandbox.ID,
 		Runtime: types.Sandbox_Runtime{
-			Name:    s.Runtime.Name,
-			Options: s.Runtime.Options,
+			Name:    sandbox.Runtime.Name,
+			Options: protobuf.FromAny(sandbox.Runtime.Options),
 		},
-		Labels:     s.Labels,
-		CreatedAt:  s.CreatedAt,
-		UpdatedAt:  s.UpdatedAt,
-		Extensions: s.Extensions,
-		Spec:       s.Spec,
+		Labels:     sandbox.Labels,
+		CreatedAt:  sandbox.CreatedAt,
+		UpdatedAt:  sandbox.UpdatedAt,
+		Extensions: extensions,
+		Spec:       protobuf.FromAny(sandbox.Spec),
 	}
 }
 
 // FromProto map protobuf sandbox definition to Sandbox struct
-func FromProto(p *types.Sandbox) Sandbox {
+func FromProto(sandboxpb *types.Sandbox) Sandbox {
 	runtime := RuntimeOpts{
-		Name:    p.Runtime.Name,
-		Options: p.Runtime.Options,
+		Name:    sandboxpb.Runtime.Name,
+		Options: sandboxpb.Runtime.Options,
+	}
+
+	extensions := make(map[string]typeurl.Any)
+	for k, v := range sandboxpb.Extensions {
+		v := v
+		extensions[k] = &v
 	}
 
 	return Sandbox{
-		ID:         p.SandboxID,
-		Labels:     p.Labels,
+		ID:         sandboxpb.SandboxID,
+		Labels:     sandboxpb.Labels,
 		Runtime:    runtime,
-		Spec:       p.Spec,
-		CreatedAt:  p.CreatedAt,
-		UpdatedAt:  p.UpdatedAt,
-		Extensions: p.Extensions,
+		Spec:       sandboxpb.Spec,
+		CreatedAt:  sandboxpb.CreatedAt,
+		UpdatedAt:  sandboxpb.UpdatedAt,
+		Extensions: extensions,
 	}
 }
diff --git a/sandbox/store.go b/sandbox/store.go
index fd467aadb..d81a17e77 100644
--- a/sandbox/store.go
+++ b/sandbox/store.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/gogo/protobuf/types"
+	"github.com/containerd/typeurl"
 )
 
 // Sandbox is an object stored in metadata database
@@ -32,19 +32,19 @@ type Sandbox struct {
 	// Runtime shim to use for this sandbox
 	Runtime RuntimeOpts
 	// Spec carries the runtime specification used to implement the sandbox
-	Spec *types.Any
+	Spec typeurl.Any
 	// CreatedAt is the time at which the sandbox was created
 	CreatedAt time.Time
 	// UpdatedAt is the time at which the sandbox was updated
 	UpdatedAt time.Time
 	// Extensions stores client-specified metadata
-	Extensions map[string]types.Any
+	Extensions map[string]typeurl.Any
 }
 
 // RuntimeOpts holds runtime specific information
 type RuntimeOpts struct {
 	Name    string
-	Options *types.Any
+	Options typeurl.Any
 }
 
 // Store is a storage interface for sandbox metadata objects