Agent Substrate
Sandboxed Kubernetes runtime that snapshots and resumes idle AI agents
What it is
Agent Substrate runs agents and other stateful workloads on Kubernetes inside gVisor or Cloud Hypervisor microVM sandboxes, fitting many actors into a few pre-started worker pods. Idle actors are snapshotted out of memory with their RAM and filesystem state, then restored on the next request. Each actor gets a short-lived SPIFFE identity, default-deny networking, and an egress gateway that injects credentials outside the sandbox. Platform teams use it to host untrusted agents, coding environments, and MCP servers at high density without giving them access to secrets.