Google Donates Its Agent Runtime to the CNCF and Ships 1.0

Google Cloud used November 5 to hand three of its open source agent projects to the Cloud Native Computing Foundation. Agent Substrate, gVisor, and OpenRL were accepted into the CNCF Sandbox last month; now they are being donated outright. At the same time, Agent Substrate reached 1.0 and became generally available as a managed runtime on Google Kubernetes Engine.

What was actually handed over

Agent Substrate separates a stateful agent from the compute it runs on. Actors hold each agent's memory, files, and identity. Workers are reusable sandboxes drawn from a warm Kubernetes pool. Gateways inject secrets based on Actor identity, so keys never enter the agent environment. When an agent pauses on a model turn or tool call, Substrate snapshots it to storage and returns the Worker to the pool, restoring the session elsewhere in under 500 milliseconds.

Google says the runtime now handles millions of sandboxes at ten times standard container density and more than 500 suspend-resume operations per second, with over 100 contributors. Nous Research is building Hermes Enterprise on it and the CNCF project kagent already uses it.

gVisor isolates untrusted generated code in a userspace kernel. Anthropic and OpenAI use it to contain code execution; Modal and Snowflake run sandboxes on it; Ant Group and Tencent run it at scale. Google's stated reason for donating is blunt: sandbox providers carry host kernel patches that bring gVisor's I/O near native Linux speed, but upstream maintainers refused to merge them while one vendor owned the project. Ant Group, Modal, and Tines are joining as maintainers.

OpenRL runs self-hosted reinforcement learning post-training on Kubernetes through four primitives behind a Tinker-compatible API, keeping weights and data on your own cluster, with GPU time-slicing between sampling and training via llm-d.

Why it matters

Agents execute code for seconds, then wait. A container per agent wastes memory and CPU through every pause, and a Pod per agent overloads the Kubernetes control plane. Snapshot-and-restore is the serverless trick applied to stateful, identity-bearing agents - and it is now neutral property rather than a vendor feature.

What builders should do

Measure the gap between your peak and average agent concurrency: that gap is what a snapshot runtime recovers. If your agents run generated code, gVisor is the pragmatic isolation default. If you are post-training for agentic tasks, OpenRL is worth a pilot because it does not require forking a monolithic RL framework. Google presents the stack at KubeCon North America in Salt Lake City, November 9 to 12.

For the tooling side of the same shift, our earlier coverage of Meta's Conductor acquisition looked at how agent workspaces are consolidating.