[Sandbox] Agent Substrate

### Project summary

A high-density, low-latency runtime environment for large-scale AI agent deployments on Kubernetes.

### Project description

Agent Substrate delivers a performant, high density runtime environment for large scale agent deployments. The agent substrate control plane provides full lifecycle management for agent sandboxes, delivering sub-second agent resume/suspend operations, and allows heavy multiplexing of agents onto the same computer infrastructure. It supports multiple sandbox technologies including microVMs and gVisor, enabling consistent lifecycle operations for all sandbox types.

At its core, Agent Substrate maps a larger set of “actors” (applications such as agents) onto a smaller set of ready “workers”, relying on the fact that agent-like applications tend to be idle most of the time to achieve heavy multiplexing. It provides functionality to manage an actor’s lifecycle (e.g. create/destroy, suspend/resume), to assign actors to workers in real time, and to route incoming traffic to them.

Agent Substrate leverages Kubernetes for the infrastructure provisioning and worker lifecycle management (Kubernetes Pods). It builds on top of Kubernetes features like Pods and Pod autoscaling, while Agent Substrate provides agent-specific scheduling and control to achieve lower latency. Using Kubernetes as the underlying system enables consistent infrastructure management across all workloads types that are required for end to end agentic deployments and allows holistic infrastructure optimizations for RL scenarios that span agentic, inference and training cycles.

Agent Substrate bridges the gap between traditional container orchestration and the unique operational demands of agentic systems. It provides an agent-aware networking mesh and proxy (atenet) for location-transparent routing and on-demand reactivation, modular sandboxing across gVisor and microVMs (Kata Containers / Cloud Hypervisor), and framework-agnostic support for harnesses such as Agent Development Kit (ADK), LangChain, Claude Code, CodeX, and Model Context Protocol (MCP) servers.

### Project vs Reference Architecture/Implementation

- [x] This is a reusable open source project designed for broad adoption, not a reference architecture, reference implementation, or demonstration of patterns

### Org repo URL (provide if all repos under the org are in scope of the application)

https://github.com/agent-substrate/

### Project repo URL in scope of application

https://github.com/agent-substrate/substrate

### Additional repos in scope of the application

We have a list of integration repos under the [https://github.com/agent-substrate/](https://github.com/agent-substrate/substrate) organization. All other repositories except https://github.com/agent-substrate/substrate are private at the moment. We are actively evaluating if they should be a part of the sandbox application. We will remove them from the organization if we have decided otherwise in the next 1-2 weeks.

### Website URL

https://github.com/agent-substrate/substrate

### Roadmap

https://github.com/agent-substrate/substrate/blob/main/docs/roadmap.md

### Roadmap context

- **Architecture & Actor Lifecycle**: Defining granular lifecycle transitions, actor versioning via ActorTemplate, introducing Atespace groupings for authorization policy, and implementing actor branching/forking from checkpoints to support multi-path agent reasoning.

- **Wakeup Latency & Snapshot Tiering**: Reaching sub-100ms p95 activation latency through tiered caching (local zswap, local SSD, peer-to-peer, and object storage), incremental snapshots, and disk-only resume modes for cold-start agents.

- **Control Plane & Storage Scalability**: Scaling the ateapi gRPC control plane and PostgreSQL state store with partitioning to support 1M+ concurrent actors, alongside automated garbage collection of idle actors based on configurable TTLs.

- **Identity & Authorization**: Implementing independent cryptographic actor identities, mTLS across all control/data plane paths, and in-band actor-to-actor (A2A) calling policies.

- **Dynamic Networking & Security**: Enforcing zero-trust boundaries with default-deny network isolation, Envoy ext_proc ingress routing, and transparent credential injection via proxies to avoid exposing bearer tokens to untrusted sandboxes.

- **Runtime Modularity & Framework Integrations**: Expanding multi-sandbox support (gVisor and microVMs via Kata Containers and Cloud Hypervisor) and delivering first-class connectors for the Agent Development Kit (ADK), LangChain remote tool execution, Model Context Protocol (MCP) server hosting, and stateful coding environments (Claude Code / CodeX).

### Contributing guide

https://github.com/agent-substrate/substrate/blob/main/CONTRIBUTING.md

### Code of Conduct (CoC)

https://github.com/agent-substrate/substrate/blob/main/CODE_OF_CONDUCT.md

### Adopters

An ADOPTERS.md file will be published as adoption formalizes.

### Maintainers file

https://github.com/agent-substrate/substrate/blob/main/MAINTAINERS.md

### Security policy file

https://github.com/agent-substrate/substrate/blob/main/.github/SECURITY.md

### Standard or specification?

N/A

_Note: While Agent Substrate defines declarative Kubernetes CRDs—including WorkerPool, ActorTemplate, and SandboxConfig—and a gRPC lifecycle interface for interior sandboxes (ateom), it operates primarily as an open-source software runtime rather than a formal specification body_

### Business product or service to project separation

Agent Substrate is developed as an independent, fully open-source upstream runtime engineered to run on any conformant Kubernetes cluster (including local kind clusters, on-premises Kubernetes, or any cloud managed Kubernetes offering). It is not a commercial product, SaaS offering, or proprietary service.

While engineers from Google Cloud contribute to the project, Google's business model is strictly infrastructure-centric ("be the best cloud for at-scale agent-native companies"), where users run open-source software on standard compute VMs that they purchase and manage. The project is explicitly governed in vendor-neutral repositories under https://github.com/agent-substrate, utilizes standard open-source APIs, and maintains no proprietary hooks. Donating Agent Substrate to the CNCF ensures that governance, roadmap planning, and trademark ownership reside with a neutral foundation, eliminating single-vendor ownership concerns and fostering equitable participation across cloud providers, hardware vendors, and the broader AI ecosystem.

### Why CNCF?

Agent Substrate is purpose-built to extend Kubernetes to meet the operational and economic demands of large-scale, stateful agentic workloads. The CNCF is the canonical home of Kubernetes and the cloud-native ecosystem.

Transitioning Agent Substrate to the CNCF provides critical value across three dimensions:

- **Neutral Governance and Industry Trust**: Single-company stewardship deters major industry peers and cloud providers from adopting and contributing to the project. Neutral CNCF ownership removes vendor lock-in concerns and establishes an open foundation for cross-industry collaboration across cloud providers (Google, Microsoft), hardware vendors (NVIDIA), and independent software vendors (Solo.io).

- **Ecosystem Ubiquity and Standardization**: Agentic infrastructure is rapidly fragmenting into proprietary, DIY runtimes that bypass Kubernetes or suffer from poor hardware utilization. The CNCF provides the governance framework necessary to establish Agent Substrate as the open, ubiquitous "Kubernetes for agents" industry standard.

- **Synergy with Cloud Native Technologies**: The project deeply integrates with CNCF graduated and sandbox technologies (Kubernetes, Envoy, CoreDNS, Prometheus, OpenTelemetry, SPIFFE). Joining the CNCF accelerates technical alignment, community growth, and cross-project interoperability.

### Benefit to the landscape

Adding Agent Substrate introduces a dedicated, high-density agentic compute runtime to the Cloud Native Landscape. Traditional Kubernetes architectures assume long-running, continuous container processes where Pod creation, scheduling, and image pulling take multiple seconds. In contrast, AI agents are bursty, stateful, and interactive—spending up to 90%+ of their time idle waiting for human prompts, tool outputs, or model responses.

Agent Substrate enhances the landscape with critical new capabilities:

- **30x–100x Density via Worker Multiplexing**: Decouples logical actors from physical pods, dynamically multiplexing thousands of idle agent instances onto a small pool of active worker pods.

- **Sub-Second State Restoration**: Enables true suspend and resume with sub-second activation targets, capturing and restoring in-memory (RAM) and local filesystem state via gVisor process checkpoints or microVM (Cloud Hypervisor) memory snapshots.

- **Agent-Aware Traffic Routing**: Incorporates an Envoy-driven networking layer (ext_proc) and CoreDNS mesh that transparently intercepts inbound traffic, automatically wakes up the target actor, routes the payload, and hibernates the actor after inactivity.

- **Preventing Ecosystem Fragmentation**: Provides a standardized, open-source substrate that prevents developers from abandoning Kubernetes in favor of un-orchestrated VMs or proprietary serverless silos.

### Cloud native 'fit'

Agent Substrate fits into the App Definition and Development and Runtime / Container Runtime categories of the CNCF Landscape, operating as an agentic compute orchestration and sandbox management layer directly atop Kubernetes.
It exemplifies cloud-native principles by:
- **Declarative Kubernetes Architecture:** Exposes custom resources (WorkerPool, ActorTemplate, SandboxConfig) managed via standard Kubernetes controllers, integrating natively with Kubernetes RBAC, node scheduling, and autoscaling (HPA).

- **Container & Sandbox Portability**: Packages actor workloads as standard OCI container images and runs them across pluggable sandbox runtimes (gVisor runsc and Kata Containers microVMs) for strong multi-tenant isolation.

- **Decoupled Microservice Control Plane**: Employs a decoupled architecture comprising ateapi (gRPC control plane), atelet (node supervisor DaemonSet), ateom (interior sandbox agent), and atenet (Envoy proxy and DNS controller) communicating over mutual TLS.

- **Cloud-Native Observability**: Instruments all lifecycle operations and actor executions with OpenTelemetry metrics, OTLP tracing, and Prometheus scrapers.

### Cloud native 'integration'

Agent Substrate complements and integrates with several core CNCF projects:

- **Kubernetes (Graduated)**: Agent Substrate is built on Kubernetes. It relies on Kubernetes for infrastructure provisioning, WorkerPool pod lifecycle, CRD reconciliation (atecontroller), and node scheduling.

- **Envoy Proxy (Graduated)**: Powers the atenet-router ingress gateway. Substrate uses Envoy with an external processor (ext_proc) filter to inspect inbound HTTP/CONNECT traffic, query the control plane to resume suspended actors, and dynamically route connections via authenticated mTLS tunnels.

- **CoreDNS (Graduated)**: Integrates custom DNS plugins and controllers to resolve location-transparent actor domain names (..actors.resources.substrate.ate.dev) and inject stub domains into cluster DNS.

- **OpenTelemetry (Graduated) & Prometheus (Graduated)**: Implements native OTLP metric and distributed trace export across ateapi, atelet, and worker runtimes, alongside Prometheus metrics for Horizontal Pod Autoscaling.

- **SPIFFE/SPIRE** (Graduated): Employs SPIFFE identity primitives (via go-spiffe) and automated Pod Certificate signing (podcertcontroller) for cryptographic mTLS verification across all internal daemon and proxy flows.

- **Kata Containers (Open Infrastructure Foundation (OIF) / CNCF adjacent)**: Supported as a first-class sandbox class (ateom-microvm) leveraging Cloud Hypervisor microVMs and user-faultfd memory demand-paging.

- **kagent (CNCF Sandbox):** Directly complements kagent, acting as the underlying high-density, stateful execution runtime for kagent's AI agents.

### Cloud native overlap

Agent Substrate has slight, complementary overlap with Kubernetes, Knative (Serverless / Serving) and Kueue (Batch Job Queuing), but serves a distinct operational profile:

- **Kubernetes**: Kubernetes is an orchestrator for running containers (workloads) on machines (infrastructure). Agent substrate orchestrates sandboxed “actors” (workloads) on “workers” (infrastructure). Superficially they overlap, but the details are very different in scope (K8s runs just about any workload, substrate focuses on agent-like workloads only), scale (K8s can reach O(100K) distinct workloads, substrate aims for O(100M) or more, and mechanism (K8s starts and stops containers, substrate suspends and resumes sandboxes and microVMs). Agent substrate is built on top of Kubernetes, allowing it to extend to this new class of workloads in a way that it can’t do natively.

- **Knative Serving**: Both projects scale workloads to zero based on incoming request traffic. However, Knative manages coarse-grained container cold-starts (creating and scheduling new Pods via kube-apiserver), which incurs multi-second latency and destroys volatile in-memory state. Agent Substrate operates at a sub-pod level: it maintains warm worker pods and executes sub-second in-memory (RAM) checkpoint/restore, preserving full conversational and execution memory across suspends.

- **Kueue**: Kueue manages job queuing and resource quotas for batch and ML training jobs across Kubernetes clusters. Agent Substrate manages interactive, real-time agent execution sessions with sub-second latency targets, focusing on density and memory snapshot teleportation rather than batch job scheduling.

### Similar projects

Outside the CNCF, several projects explore agent sandboxing or microVM execution:

- **Open-source projects:** Firecracker (AWS), Cloud Hypervisor, gVisor, vLLM / Ollama (for model inference, whereas Substrate manages the agent runtime), and execution sandbox platforms like E2B and OpenShell.

- **Commercial / proprietary agent platforms**: Daytona, Modal, Fly.io Machines, and internal proprietary sandbox runtimes in frontier AI labs.

**Key Differentiator**: Most existing tools either constrain themselves to traditional full-instance VM provisioning or lack Kubernetes-native orchestration. Agent Substrate uniquely combines Kubernetes custom resources, high-density multiplexing (juggling hundreds of actors onto a few physical pods), and sub-second in-memory suspend/resume across gVisor and microVMs.

### Landscape

No

### Insights

https://insights.linuxfoundation.org/project/agent-substrate

### Trademark and accounts

- [x] If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF

### IP policy

- [x] If the project is accepted, I agree the project will follow the CNCF IP Policy

### Will the project require a license exception?

N/A - Project uses Apache 2.0 license

### Does the project utilize any dependencies with licenses not on the allowlist or an approved exception?

N/A - All licenses are on the allowlist or an approved exception

### Project "Domain Technical Review"

The project completed an informal Sandbox Readiness Assessment directly with CNCF TOC Chair Karena Angell on August 6, 2026. Active community discussions and dedicated user/dev channels are established on CNCF Slack (#substrate-users, #substrate-dev). The project hosts weekly community meetings every Thursday from 10:00am–11:00am PST with public [meeting notes](https://docs.google.com/document/d/1obSIvfcafLNniLYTQCcT2eCgxHqa2AQ3Ga7YTsju49s).

### Application contact email(s)

zlammerts@google.com, thockin@google.com, broyal@google.com, bentheelder@google.com

### Contributing or sponsoring entity signatory information

### CNCF contacts

- **Karena Angell** (CNCF TOC Chair) — Conducted the preliminary Sandbox Application Readiness Assessment for Agent Substrate on August 6, 2026.

- **Tim Hockin** (Google / Kubernetes co-founder & maintainer)

### Additional information

**Project Growth & Velocity**:

- **Public Release**: May 2026 (~3+ months active public development)

- **GitHub Stats**: 1.8k+ stars, 307+ forks

- **Contributor Diversity**: 90+ human contributors across 4+ organizations (Google, NVIDIA, Solo.io, Microsoft)

- **Community Infrastructure**: Weekly Thursday community sync meetings (10:00am–11:00am PST), public YouTube recordings ([@agent-substrate](https://www.youtube.com/channel/UCN9PPqlTtVxlcpbQ-NWpfZQ)), CNCF Slack channels (#substrate-users, #substrate-dev), and Google Groups mailing list (ate-dev@googlegroups.com).

- **Target Launch Milestone**: Planned public transfer announcement at KubeCon North America (November 2026).

**Pre-Submission Readiness & Onboarding Alignment**: The maintainers are actively addressing the recommendations from the TOC Chair readiness assessment prior to filing, including ratifying GOVERNANCE.md to remove draft status, creating MAINTAINERS.md with multi-org representation, and verifying vendor-neutral kind quickstarts as the primary development workflow. Upon TOC approval, the project will immediately execute the CNCF onboarding checklist, including DCO adoption and CNCF Code of Conduct integration.