Powering open infrastructure for autonomous agents

As AI shifts from human scale to agent scale, from systems of record to systems of action, and from simple requests to complex agentic workflows, the workload underneath your platform changes completely. An agent works in a continuous, stateful loop: It proposes an action, spins up subagents, executes code or tool calls inside a sandbox, and feeds the results back into the model for the next turn. Running that loop at scale requires the same open foundation and neutral governance that Kubernetes and the Cloud Native Computing Foundation (CNCF) brought to containers in the 2010s. Today, we are announcing the donation of Agent Substrate, gVisor, and OpenRL, three open source projects that started at Google, to the CNCF following their acceptance last month into the CNCF Sandbox. To bring this open stack into managed production and accelerate it across TPUs and GPUs, we are also announcing that Agent Substrate has reached its 1.0 milestone and is now generally available as Agent Substrate on GKE. Each project is now working through CNCF Sandbox onboarding with community maintainers and independent build infrastructure, and gVisor is on a path toward Incubation. These releases deliver an open stack that runs on any Kubernetes cluster, on any cloud, across CPUs, GPUs, or TPUs, by: Scaling isolated agent environments without idle compute overhead with Agent Substrate (now 1.0 and GA on GKE): Agents execute code or tests for a few seconds, then wait on model turns, external APIs, or human input. Keeping a dedicated container alive during those pauses ties up memory and compute. Agent Substrate decouples stateful agent sessions and identities from active compute, snapshotting idle agents to storage and restoring them in under 500 milliseconds to run millions of sandboxes at 10x container density. Isolating untrusted code within a sandbox with gVisor: Agents routinely generate and run unreviewed code and external packages, making standard containers that share a host Linux kernel a security risk. gVisor isolates generated code inside a lightweight userspace application kernel at container packing density on any Linux node. Distributing post training and serving efficiently with OpenRL: Training agents with reinforcement learning (RL) gives builders an open loop to learn across millions of parallel sandboxed rollouts. OpenRL orchestrates self-hosted RL post-training loops in plain Python on Kubernetes. Scale fully isolated agent environments with Substrate Agents need isolated compute resources and strict access boundaries, yet spend most of their time waiting: executing code for a few seconds, then pausing while a model reasons or a human responds. They need a discrete identity and central enforcement point to ensure the agent only accesses authorized tools and services without holding sensitive keys. In standard Kubernetes, giving every active agent its own Pod locks up memory and CPU while the agent sits idle, forces the control plane to track millions of persistent objects it was never designed to hold, and ties identities directly to Pods. At the same time, identities are intrinsically tied to Kubernetes Pods, adding exponential complexity for controlling access and secrets. Agent Substrate solves this by separating the stateful agent from the underlying compute: Actors hold each agent's memory, files, and discrete identity. Workers are reusable execution sandboxes drawn from a warm Kubernetes pool. Gateways enforce inbound and outbound access control and inject secrets based on Actor identity, keeping sensitive keys out of the agent environment. When an agent pauses to wait on a model turn or tool call, Agent Substrate snapshots the agent’s memory and files to storage and immediately returns the Worker to the warm pool. When the next request arrives, Agent Substrate restores the Actor onto any available Worker in under 500 milliseconds and picks up right where it left off. Think of it as a hotel room rather than a house: you don't keep a room when you leave town, and a new room is ready when you come back. Agent Substrate decouples stateful Actors and policy Gateways from a warm pool of Kubernetes Workers, restoring idle sessions in under 500 milliseconds. Since public development started in May 2026, the Agent Substrate project has grown to more than 100 contributors. Early design partners like Nous Research are building Hermes Enterprise on it, and it already powers other CNCF projects like kagent. Further, reaching the 1.0 milestone shows that Agent Substrate can accept production workloads across millions of sandboxes, achieving 10x the density of standard container runtimes, and performing more than 500 suspend and resume activations per second. Underneath, you can choose Cloud Hypervisor microVMs or gVisor as your isolation boundary without changing how you manage agent lifecycles. Because Agent Substrate runs standard OCI containers, it works out of the box with Ag

Extras afișat conform termenilor RSS ai publicației · 200 cuvinte · textul integral și figurile sunt pe site-ul publicației