Google gave Agent Substrate and gVisor to the CNCF. Neutral governance is now a criterion for agent runtimes

One detail in Google’s announcement explains the rest of it. Google proposed changes to the Linux kernel to help gVisor, its sandbox for untrusted code. Upstream maintainers declined to merge them while the project was owned by a single vendor.

That is the problem Google is now solving for agent infrastructure. On November 5 it announced that Agent Substrate reached version 1.0 and general availability on GKE, and that it has donated Agent Substrate, gVisor and OpenRL to the Cloud Native Computing Foundation, after the projects were accepted into the CNCF Sandbox in October.

What we wrote in October, and what changed

When we first looked at Agent Substrate, we argued that it was built for fleets of agents, not one, and that it shifted work onto platform teams. The architecture is the same. Its status is not.

Agent Substrate separates an agent’s durable state from the compute that runs it. Actors hold memory, files and identity. A warm pool of reusable Kubernetes Workers picks them up when there is work. Gateways enforce access control and inject secrets, so credentials do not live inside the agent. Isolation uses Cloud Hypervisor microVMs or gVisor. It runs standard OCI containers and works with Google’s Agent Development Kit.

Google’s figures, from its own announcement: idle agent sessions restore in under 500 milliseconds, more than 500 suspend and resume operations run per second, and container density is ten times that of standard container runtimes. The point is economic. Plain Kubernetes ties an identity to a Pod and keeps its memory and CPU reserved while the agent waits, which for most agents is most of the time.

The new parts are three: the 1.0 version, general availability as a managed GKE feature, and a home at the CNCF. Google says the project has had more than 100 contributors since May, and names Nous Research, SPIRITT and the CNCF project kagent among those building on it.

What the CNCF move buys

A runtime others can adopt without adopting Google. gVisor already runs millions of sandboxes a day inside Google’s services, and Google lists Anthropic, OpenAI, Modal, Snowflake, Ant Group, Tencent and Northflank as users. Ant Group, Modal and Tines have committed maintainers. Under foundation governance, a competitor’s contribution no longer strengthens a rival’s product alone. That is how open infrastructure gets adopted widely.

A standard shape for agent state. If the Actor and Worker split becomes common across clouds, agent memory, files and identity can be described the same way everywhere. That matters for anyone who has argued, as we have, that lock-in is moving to the agent’s accumulated state.

OpenRL in the same place. OpenRL, the third donation, provides a self-hosted reinforcement learning post-training loop on Kubernetes. It started as a research preview in February, and TPU support is still on the roadmap.

What it does not buy

A CNCF project and a managed GKE feature are different things. The general availability, the support terms and the performance figures above apply to Google’s managed version. Running the open project yourself means operating the warm pools, the gateways and the isolation layer with your own team.

Sandbox is also the CNCF’s earliest maturity stage. It signals intent, not stability. Graduation depends on a broad maintainer base forming over the next year or two.

For platform teams, the practical change is in procurement. A year ago, an agent runtime was a vendor feature. Now there is an open candidate with a governance model. Ask every agent platform vendor the same question: can our agents’ state and isolation move to an open runtime if we leave?