Repolode
Submit
agent-substrate

agent-substrate/substrate

Zero-trust sandboxed runtime on Kubernetes that maps many stateful AI agents onto a small pool of workers by snapshotting idle actors.

View on GitHub
Stars
5,550
Forks
604
Open issues
833
Last commit
10 hours ago

What is it?

Agent Substrate is a runtime for running large numbers of untrusted, mostly idle agents on standard Kubernetes. Each actor runs inside a gVisor or Cloud Hypervisor microVM sandbox with its own compute, network, and storage. When an actor is idle, its memory and filesystem state are snapshotted out of memory, and it is restored when a request arrives, so many actors can share a small pool of warm worker pods.

The security model treats every actor as hostile to the others. Actors receive short-lived SPIFFE X.509 identities, default-deny networking, and no direct access to credentials. An egress gateway, atenet-egress, injects credentials into approved outbound requests from outside the sandbox and can be replaced with a custom policy engine. The project describes itself as a low-opinion runtime rather than an agent SDK, so it can host workloads built with frameworks such as LangChain or ADK as OCI container images.

The project is pre-1.0 and its APIs may change. It ships a kubectl-ate CLI, a control plane API server, a node DaemonSet, and several demos including a stateful counter and a multi-agent Claude Code setup.

Key features

  • 01Runs each actor in a gVisor or Cloud Hypervisor microVM sandbox.
  • 02Snapshots idle actors' memory and filesystem and restores them on demand.
  • 03Issues per-actor SPIFFE X.509 identities and JWTs.
  • 04Injects credentials through an egress gateway so sandboxed code never holds them.
  • 05Uses default-deny networking with ingress routed through atenet-router.
  • 06Runs on standard Kubernetes with a kubectl-ate CLI.

Use cases

  • Hosting many stateful coding agents that keep filesystem state across sessions.
  • Running untrusted tool execution for LLM agents without exposing API keys.
  • Oversubscribing a small pool of worker pods across many mostly-idle MCP servers or agents.
  • Sharing one Kubernetes cluster between agent, inference, and training workloads.

Topics

#ai-agents#sandboxing#kubernetes#gvisor#microvm#zero-trust#serverless#mcp

FAQ

What is substrate?
Zero-trust sandboxed runtime on Kubernetes that maps many stateful AI agents onto a small pool of workers by snapshotting idle actors. Agent Substrate is a runtime for running large numbers of untrusted, mostly idle agents on standard Kubernetes. Each actor runs inside a gVisor or Cloud Hypervisor microVM sandbox with its own compute, network, and storage. When an actor is idle, its memory and filesystem state are snapshotted out of memory, and it is restored when a request arrives, so many actors can share a small pool of warm worker pods.
Is substrate free to use? What license does it have?
substrate is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is substrate still maintained?
Actively maintained. The last commit to substrate was on Oct 19, 2026.
What can I use substrate for?
Hosting many stateful coding agents that keep filesystem state across sessions. Running untrusted tool execution for LLM agents without exposing API keys. Oversubscribing a small pool of worker pods across many mostly-idle MCP servers or agents. Sharing one Kubernetes cluster between agent, inference, and training workloads.
Where can I get substrate?
The source code and installation instructions are on GitHub: https://github.com/agent-substrate/substrate

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects