Google Donates Agent Substrate, gVisor and OpenRL to CNCF, Ships Agent Substrate 1.0 on GKE

Google hands its agent stack to the CNCF

On 6 November 2026 Google donated its agent isolation stack — the Agent Substrate runtime, the gVisor sandbox kernel and the OpenRL training framework — to the CNCF's Sandbox tier, and released Agent Substrate 1.0 as a managed capability on Google Kubernetes Engine at the same time. According to a dev.to write-up by neticslabs summarising Google's announcement, the runtime has attracted more than 100 contributors since development opened in May 2026.

How Agent Substrate works

Agent Substrate runs each AI agent session as an isolated sandbox on a Kubernetes cluster, and it splits that session in two. An Actor holds the session's memory, files and identity. A Worker is a reusable sandbox drawn from a pool that is kept warm. A gateway sits on both sides of the sandbox, enforcing access rules and injecting credentials so that a secret never enters the agent's environment. When an agent pauses, the runtime snapshots its memory and files to storage and hands the Worker back to the pool.

The design targets the dead time in an agent's loop: while a model reasons or a person responds, a conventional Pod stays allocated and holds memory and CPU that nothing is using, while the control plane tracks a persistent object per agent.

Resume runs through an atenet-router proxy. An incoming request is held in memory, the Substrate controller assigns the suspended Actor to a free slot in the warm pool, state reloads from tiered storage, and the process wakes before the proxy delivers the request. Google reports restore in under 500 milliseconds, more than 500 suspend-and-resume activations per second, and roughly ten times the density of standard container runtimes, with thousands of agents waking each second without creating Pod objects or loading etcd.

Identity is per session. The GKE documentation, as cited by dev.to, says each Actor is issued a unique SPIFFE X.509 certificate and a JSON Web Token for request attribution. When an outbound request matches an egress rule, the gateway authenticates the Actor's mTLS tunnel and replaces placeholder headers with a fetched secret or the Actor's token.

gVisor and the kernel patch question

Substrate supports gVisor and Cloud Hypervisor microVMs as isolation boundaries. gVisor, open sourced in 2018, is a lightweight application kernel written in Go that handles application system calls in userspace so generated code never talks to the host kernel directly. Google says it already runs millions of sandboxes a day underneath GKE Sandbox and Cloud Run, and names Anthropic and OpenAI as users for code execution, Modal and Snowflake for execution sandboxes, and Ant Group and Tencent in production at scale.

The donation also changes gVisor's upstream outlook. Google's post, as relayed by dev.to, says sandbox infrastructure vendors, Google included, maintain host kernel patches that bring gVisor's I/O performance close to native Linux, and that Linux maintainers declined to merge them while the project had a single corporate owner. Neutral CNCF governance opens a path to upstreaming. Ant Group, Modal and Tines have committed to join gVisor's maintainers, with OpenAI, Tencent and NVIDIA continuing their contributions.

OpenRL rounds out the stack

OpenRL, first shown as a research preview in February, extends the same argument to training: the sandbox that serves an agent in production is also the environment needed to run reinforcement learning, with millions of multiturn rollouts inside real tools scored and folded back into the weights. It exposes four Python primitives — sample, forward_backward, optim_step and save_state — behind an API compatible with Tinker, and keeps weights and data on the operator's own cluster. It partitions an accelerator pool through Kubernetes Dynamic Resource Allocation, trains via PyTorch and AutoModel, samples via vLLM, and validates Gemma and Qwen out of the box. It also pairs with llm-d, the distributed inference project that reached 1.0, for prefix-aware rollout routing and for time-slicing the same GPUs between sampling and training.

Availability and operator duties

On GKE, Agent Substrate requires Standard clusters on version 1.37 or later and x86 CPU worker nodes. The operator still owns egress policy, the snapshot size that determines resume latency, and the identity each Actor carries.

Why it matters

Every platform deploying AI agents that execute generated code faces the same isolation problem, and Google has now put its answer — a warm-pool runtime, a proven sandbox kernel and an RL loop — under neutral governance rather than keeping it a Google feature. The economics matter too: snapshotting idle agents and time-slicing shared GPUs both reclaim capacity that conventional deployments waste, and Google's claimed 10x density is the kind of number that changes infrastructure budgets. The honest caveat, as the dev.to piece notes, is that gVisor's I/O advantage currently rests on out-of-tree kernel patches, and the upstream work that could change that has only just become possible.