On November 5, 2026, Google Cloud announced it would donate Agent Substrate, gVisor, and OpenRL to the Cloud Native Computing Foundation (CNCF), and announced Agent Substrate 1.0 and its general availability as a managed capability on Google Kubernetes Engine (GKE). Google said the three projects had entered the CNCF Sandbox in October and were still completing onboarding with community maintainers and independent build infrastructure. Google Cloud’s announcement describes the donation as a plan, not a completed transfer.
Three projects, three different jobs
Google describes Agent Substrate as a stateful runtime for AI agents, gVisor as an isolation technology, and OpenRL as a Kubernetes-based system for reinforcement-learning post-training. They address different parts of the work:
| Project | Role | What it does |
| Agent Substrate | Stateful agent execution | Separates an agent’s stored state and identity from the computing resources that run it. |
| gVisor | Isolation for untrusted code | Uses a Go userspace application kernel to intercept and handle system calls. |
| OpenRL | Reinforcement-learning post-training | Provides a self-hosted Python workflow for post-training on Kubernetes. |
OpenRL’s four named Python primitives are sample, forward_backward, optim_step, and save_state. Google describes PyTorch/AutoModel as training options and vLLM for sampling, and says Gemma and Qwen have been validated. TPU support is on the project’s roadmap.
Agent Substrate manages an agent’s running state; gVisor provides an isolation boundary; OpenRL handles a post-training workflow.
How Agent Substrate pauses and resumes an Actor
In Google’s description, an Actor holds an agent’s memory, files, and identity. A Worker is a reusable execution sandbox drawn from a warm pool of Kubernetes Workers. When an Actor is idle, its memory and files are saved as a snapshot, freeing its Worker to return to the pool. A later request restores the Actor on an available Worker.
Gateways enforce inbound and outbound access controls and inject secrets based on the Actor’s identity. Google says Agent Substrate can use Cloud Hypervisor microVMs or gVisor for isolation.
What Agent Substrate 1.0 on GKE means
Google announced Agent Substrate 1.0 as generally available as a managed GKE capability. Google also says the open-source code can be deployed on any Kubernetes cluster. That gives teams a choice between the managed GKE offering and deploying the open-source project on Kubernetes infrastructure they operate.
Google identifies SPIRITT Workspace as being built on Agent Substrate on GKE, and says Nous Research is building Hermes Enterprise on it.
