Agent projects expose limits of sandboxing for agent fleets
CNCF Ambassador Lin Sun of Solo.io wrote on July 7, 2026 that sandboxing alone is not enough to run large-scale AI agent fleets, contrasting the Kubernetes SIG Apps project agent-sandbox with a newer, still-standalone project called agent-substrate. Agent-sandbox provides identity, persistent storage, and lifecycle management for sandboxed agent pods; agent-substrate goes further by dynamically waking agents on invocation using lightweight sandboxes such as gVisor or Kata Containers, letting many agents share one worker pool instead of running as always-on pods. Sun's team is exploring integrating agent-substrate with kagent and agentgateway. For practitioners, the takeaway is that secure isolation and fleet-level operational efficiency are separate problems, and both need solving to run agents at scale.
Agent-fleet operators face two problems that get conflated: securing what an individual agent can do, and running thousands of agents efficiently without keeping every one active as a dedicated pod. This post argues Kubernetes-native sandboxing solves the first problem but not the second, and points practitioners toward a newer runtime pattern for the second.
What happened
CNCF Ambassador Lin Sun, of Solo.io and a maintainer of Istio, kgateway, and kagent, published a CNCF blog post on July 7, 2026 comparing two Kubernetes-based agent-execution projects. Agent-sandbox, developed as a Kubernetes SIG Apps subproject, provides a Sandbox Custom Resource Definition and controller that give agents strong identities, persistent storage, and lifecycle management including hibernation and resume. Agent-substrate, a separate standalone project Sun learned about from Bob Killen at Open Source Summit North America, focuses instead on scale and efficiency: it dynamically wakes agents on invocation using lightweight sandbox runtimes such as gVisor or Kata Containers, so many agents can share a pool of worker pods rather than each requiring an always-on pod. Sun writes that her team is exploring integrating agent-substrate with kagent and agentgateway, and that she has already migrated her own six "AIRE" agent templates to run on a single shared worker pod using agent-substrate.
Technical context
The two projects target different failure modes. Agent-sandbox addresses privilege containment, identity, and durable state through Kubernetes-native primitives, including gVisor and Kata Containers integration for kernel- or VM-level isolation. Agent-substrate decouples an agent's logical lifecycle from its worker pod, so agents behave more like on-demand, serverless workloads that can be scheduled, paused, and resumed while still relying on sandboxed isolation underneath. Agent-substrate is not yet part of any Kubernetes SIG or CNCF project, unlike agent-sandbox.
For practitioners
Sun's framing implies production agent-fleet architectures need both layers: sandbox-style security and identity controls, plus a runtime that packs and schedules agents efficiently. Teams evaluating either project should weigh maturity, since agent-sandbox sits under an established Kubernetes SIG while agent-substrate is an early-stage standalone effort, alongside integration paths into existing gateway and orchestration tooling such as kagent and agentgateway.
What to watch
Track whether agent-substrate is adopted into a Kubernetes SIG or CNCF sandbox project, how the kagent and agentgateway integration develops, and whether adopters beyond Solo.io report similar density and latency gains. This is a single-author blog post reflecting one vendor's implementation experience rather than an independently benchmarked comparison.
Key Points
- 1Solo.io's Lin Sun contrasts agent-sandbox, a Kubernetes SIG Apps project for secure agent identity and storage, with the newer agent-substrate runtime.
- 2Agent-substrate dynamically wakes agents on invocation using gVisor or Kata Containers, letting many agents share worker pools instead of dedicated pods.
- 3Sun's team is integrating agent-substrate with kagent and agentgateway, arguing fleet-scale agent operations need efficiency layered on top of sandboxing.
Scoring Rationale
A technically substantive, well-verified practitioner post from a recognized CNCF Ambassador and active maintainer, clearly distinguishing two real, independently confirmed open-source projects (agent-sandbox under Kubernetes SIG Apps; agent-substrate as an early-stage standalone effort). It is notable for infrastructure teams running agent fleets but remains a single-author blog post about early-stage tooling rather than a broad industry or product milestone.
Sources
Public references used for this report.
Practice with real Ride-Hailing data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ride-Hailing problems
