Agent Sandboxing Finds a Neutral Home at CNCF
Agents Need Guardrails, Not Blame
Agent sandboxing is becoming a core requirement as AI agents run untrusted code at scale. Agents chase their mission with single-minded focus. That makes the box around them just as important as the instructions they receive.
Google GKE Product Manager Nick Eberts examines that challenge with Alan Shimel at KubeCon + CloudNativeCon North America 2026. Google donated three projects to the CNCF that week: gVisor, Agent Substrate and OpenRL. All three are now in the CNCF Sandbox.
Two Ways to Isolate an Agent
Eberts says teams generally choose between two isolation approaches. gVisor is a user-space kernel that intercepts system calls before they reach the host. It runs as a process, so it starts quickly and uses fewer resources. It also supports fast memory checkpointing for idle agents.
MicroVMs offer traditional virtual machine isolation instead. Some teams accept a little extra latency for that added security blanket. Agent Substrate lets them pick either option based on the workload or agentic flow.
Moving Faster Than Kubernetes
Kubernetes is intentionally stable, and many organizations depend on it. Eberts notes that this stability makes it hard to keep pace with agent platforms. Agent Substrate was built to handle that velocity without changing the core project.
OpenRL tackles a different need. It runs reinforcement learning loops on Kubernetes using familiar Python tools. Teams can customize open-weight models without hand-writing piles of YAML. The goal is to reach a working training loop much faster. Shimel adds that many companies will soon run several smaller, purpose-built models.
Why Neutral Governance Matters
Google engineers remain maintainers, but competitors are already contributing. Shimel and Eberts see that as the strength of the CNCF model. Users want to mix and match tools rather than buy one massive suite.
Eberts points to Kubernetes itself as proof. Setting a project free can help it reach its potential. With agent sandboxing now under neutral governance, the wider community can shape how AI agents run safely.
Transcript
Hey everyone, welcome back. You know what? We're getting down to the end here of our KubeCon coverage for 2026.
I'm kind of sad because it was a good year to really talk to people and learn things, but I don't have much more voice high up. Right. So, it's good that we're finishing up.
We're finishing strong, though. I got Nick Eberts here from Google. He's going to talk to us.
I was telling Nick, we were lucky enough, we had some of the Google folks on earlier from Google Cloud, but that was really focused more on Substrate. Right. And Nick can talk about that, but Google made some other contributions this week- That's true.
Yeah ... that were announced, and we're going to go into them. But before we do, Nick, give people a sense of who you are, what you do.
Sure. They like to know who they're watching. Yeah.
So I'm a product manager. I'm on the GKE team. I work sort of as an overlay on our open source investments, and then I get to pick a couple of projects here and there that I'm passionate about and run with them.
I've been at Google for seven years. Good for you. I've been in technology for, I think, 25.
And yeah, I'm just having a good time riding this AI, AIoS. Absolutely. You know what?
I was just going to ask you that. Yeah. So I've been in technology a little longer than you.
Just a little. A little bit. Yeah.
But I wake up every day thankful that I'm alive and in this industry. Yeah. Because unfortunately, I gave away all my books, but I wrote this book called "The Indispensability Trap" where I looked historically at railroads, electricity, phone- Sure ...
fiber optics. I lived through the dotcom, right? I started a company, sold it, took another company public- Mm-hmm ...
rode that up all the way- Yeah ... and then all the way down. I saw that whole thing.
No, that's why I'm coming to dinner next week. Come on down. Sure.
But that being said, as exciting as that was, I never thought I'd live to see that same... Well, let's hope it ends differently. But I never thought I'd live to see that same sort of excitement, that same- Yeah ...
energy, that same, "Wow, we can build anything"- Right ... that we live in now. It's a really cool thing.
It's wild. It is. It's wild.
The things that I've been able to do personally, just on my own computer at home and like- You and me both, yeah ... it's amazing. But yeah, we do have a responsibility here, too, to make sure that...
Yes, we do. And that is, you just hit the crux on the head, right? We have a responsibility.
Yeah. Look, we're in tech. I don't think AI's going to destroy the world, but I can't tell you how many times I get asked by friends, family, what have you- Right ...
" Hell no, not exactly. It's not Skynet and Terminator's not coming, but there is a responsibility to use this to humanity's advantage, right? For sure.
And that goes for individual companies, individuals, countries, and everything else. That's actually a good segue because you were talking earlier about the things that we donated. Mm-hmm.
Substrate, you talked about. Yeah. You talked to my peers, I forget, maybe Brandon or- No, Dimitri and Drake.
Dimitri and Drake, great. PM engineer. Yep.
Perfect. Substrate's one, I think you know what that is. Yep.
There's another one that we donated called gVisor. Now, gVisor we've had running in Google and open source for a while, but we had to put it in a neutral CNCF sandbox. It's the right thing to do.
Right thing to do. But it addresses this concern of that we have, this responsibility that we have to sort of encapsulate agents that are running- Yes ... in an untrusted area.
It's all on your live TV. Yeah. And to make sure they're not breaking out and doing harm, right?
Because we've seen the news. Right. We know what happens when they could break out.
Yeah. So we need to really make sure that we're putting guardrails around them. Well, you know, it's funny, I have a theory on this.
Yeah. My mom always told me there was no bad kids and no bad dogs. Okay.
There are bad parents- Sure ... or bad dog owners. I don't think there's bad agents.
Mm. I think agents do what we program them to do, which is usually fulfill a mission, right? You have a military background, you know.
Right. The agent has a mission, and it's going to do whatever it can figure to do- 100% ... to complete the mission.
Almost to a fault. Beyond. Right.
Mm-hmm. Beyond what we would think- Yeah ... well, because they're not human.
They're single-minded- Yeah ... single purpose. This is the mission.
It's up to us to either program that mission differently- Sure ... or put in the guardrails, put in the box, that it can only fulfill its mission within these parameters. Yeah, 100%.
And so that's what one of the projects we open sourced- So how does it do it? Let's get geeky a little bit. Okay.
Yeah. Well, so gVisor's been around for a while, and in the space right now, you're going to see two technologies that they're sandboxing with. Like the agent scale, everything has to be small, has to start up quick, has to be able to suspend and resume, be compute efficient, respond quickly.
And so the two choices you have right now in general are user kernel sandboxes, which is what gVisor is. Yeah. It's intercepting sys calls and preventing them from doing things you don't want them to do.
And then just old school VM layer isolation. Got it. So it's got these mini VMs, and so that's your choice.
Let's think about this. Yeah. The mini VMs are not running in Kubernetes, though, are they?
They are. Really? Yeah.
Oh, that's cool. Yeah, so that's part of the thing that Substrate did. So when you use Substrate, you have a choice on your sandboxing technology.
And Substrate's open source, so there's going to be other mini VM providers that'll work, but I'll just speak to the ones at Google that I know work. So we have, I think it's called Google Cloud mini VM. Don't quote me on that.
I might actually get that wrong. I'm sorry, Marco. Okay.
But it's that or you have gVisor. And gVisor, again, is going to be faster because it's a process. It's not a whole VM.
Right. It's going to start up quicker. It's going to be more efficient on resources.
But it does share CPU space with other instances of gVisor. So you have- But not with gVisor. That's the only thing it shares with.
Yeah. Okay. So the- So they're all on the same plane, all of the VMs ...
yeah, it puts you in user space, but there are some things that are shared. I think right now the sys calls that we're blocking are like we're 80% coverage, and the other 20%, not typically things that you have to worry about. But we're in this world where you're running these massively intelligent models inside these sandboxes, so sometimes people want a security blanket- Yeah ...
and they just want good old fashioned VM isolation. Yes. And they'll sacrifice maybe 100 milliseconds of latency or 250, depending on which technology you use, for that security blanket, and that's what the microVMs are for.
The way that those work, Kubernetes needs an object to deploy things. Yeah. A lot of containers provides that object.
Yeah. MicroVMs is like the implementation of that object. And so when you're using Substrate, you can use either one, and so you can decide based on workload or agentic flow.
Do you want to go gVisor? Yeah. You know, it reminds me back in the day in security, we used to talk about micro perimeters.
Mm-hmm. Because back then you'd have a perimeter around a castle. The micro perimeter was basically they put you within your own virtual machine.
Sure. We didn't have Kubernetes. Right.
We didn't have all of this. Yeah. It got real messy.
Yeah. Because I mean, from a management point of view- Mm-hmm ... it is- It's still messy when you really think about it.
Like when you use Substrate- I was hoping you guys figured it out. No, no, we're hiding the mess, but when you use Substrate, you're taking an entire machine, whether it be a VM or a literal bare metal machine, and you're deploying a pod on it that's taking all the resources that agent Substrate processes don't need, but for the actual agents or the things you want to launch. And then you're actually launching processes inside that pod, which is not how Kubernetes was intended.
No, not at all. Well, I don't think Kubernetes was intended to put VMs on top of it. I thought the VMs went underneath.
They ran on top of the VMs- Right. Yeah ... or bare metal.
But yes. So you're injecting these processes that are really tiny VMs. Well, we're off the beaten path here.
Yeah, I'm sorry. No, no, I'm- No, no, but- We're going off the beaten path ... but it's necessary ...
running things like this. " No, no, actually I know for sure because I talked to him all the time. That is not the use case, and that is why Substrate came about.
Okay. To handle that, handle the velocity of change of the clusters that are required in these agent platform kind of environments. And we needed to move fast.
Like Kubernetes is boring. Yep. In a good way.
So many people rely on it. One of my jobs is to help make sure that we're doing things at a responsible rate, making investments in the right place to move the project along. But it can't go fast like it used to.
No. So you're not going to go fast enough to meet the demands of the agent platforms. Today.
Today. You know what? But like I said in the beginning- Yeah ...
you go to war with the army you have. Sure. If you got something that's going to make you go faster, securer, and all of that, show it to me.
Right. Otherwise- Yeah ... I've had this discussion all through the week here with people.
Yeah. The moaners. You always get people moaning and groaning, "Oh, this isn't perfect.
That's not perfect. " Are you a human? What is perfect?
Exactly. Aside from my wife and kids. Yeah, exactly.
I hear you. But there was a third new open source project adopted. OpenRL.
Kaiser, Substrate, and OpenRL. OpenRL, yeah. So reinforcement learning's big.
You want to be able to train your models for their specific use case for more close to the use case that you're intending, like some specific domain. And a lot of people, when they're doing this in a smaller form factor, I'm not talking really about the frontier relationship. No, I get it.
Yeah, I'm talking like smaller instances. They're using this thing called Tinker. It's an API.
I'm just going to be honest with you, I'm not totally up to speed on Tinker API, but what I will tell you that OpenRL does is it takes that Tinker API that people like to use, and it implements the infrastructure underneath it. So you're just using the same Python libraries that you're used to, and then OpenRL will deploy the Kubernetes objects that represent that RL pipeline- Wonderful ... and get it set up and staged.
And so it just should help you get from zero to one on an RL loop and a Kubernetes cluster faster because otherwise you're writing YAML or asking the agent to write YAML. No, but who the heck... I was going to say something else, but who the heck wants to write YAML?
Right. That's the whole point. It's interesting, we did this thing called Futurum Summit Monday morning for breakfast.
Sure. We had a couple of panels, and one of the things that came out at the panels, Nick, is we're at the point right now where really you can build your own model, and you can start training your own model. Right.
As a matter of fact, you could have Claude or Gemini or any of these, start building your own model. We don't need that frontier model with all the tokens for a good chunk of what we do. Right.
And so I think the future is we're going to have personal models. Right. Companies will have multiple models.
We'll have harnesses. I want to use this model for this. I may use the frontier model for that.
Yeah. And so anything that's going to make learning, training models easier, building and training- For sure ... the models easier is going to be a huge win.
Right. And with OpenRL, the whole point is you can take these open-weight models and then customize it. It's crazy.
But can you take, like if I did a model from scratch, I built my own model, right? Yeah. Well, it starts with the open weights.
Starts with the open weights. Okay, and then you build from there. Then you can go from there.
So these were both given to- CNCF ... CNCF. All three.
Yeah. And they're in Sandbox? Sandbox, yep.
And fair, those following at home, CNCF has a whole hierarchy of projects- Right ... culminating in a graduation, if they're graduated. Sandbox, I think, is one of the first ones.
It's the first stage. Yeah. Right.
And not every project makes it out of Sandbox. No. But I'm pretty sure these projects are going to move because the space...
Well, these projects are exactly why people have been whining and groaning about it doesn't go fast enough. I need more bandwidth, I need more scale. Yeah.
These are meant to address some of those things. I know. Now, the other thing about the way CNCF works is that doesn't mean Google's washed their hands of these things.
No. Right? You guys are still sort of the driving- Yes ...
force. There'll be a formal- The maintainers are Google engineers, but we are definitely working with a lot of other- No, there'll be a whole governing board set up. Yeah.
That's the beauty of this whole CNCF model. Yeah. Right?
And there may be companies that compete with Google. Right. 100%.
That's okay. It already is. If you go look at the contributors for Substrate, you'll see it.
Yeah, but that's okay, because that's what makes this community what it is. Right. That is one of the key values of all of these smaller projects is that you can, as a user, as a company who's building a platform, you can pick and choose which projects or which tools that you want.
And if we're doing our job, you should be able to mix and match. " Nobody wants that anymore. No.
They want to pick the things that make the most sense for them- Most the way ... and orchestrate them together, and they want to make sure that the providers that they're dealing with are going to have integration points, which is what we're really doing here. So, but again, I want to emphasize- Sure ...
this is the beauty of this whole CNCF model, that we're all going to be able to do that. Because people at home, I've had this question. They find out like Kubernetes itself was donated by Google.
Right. Why would Google give Kubernetes away? Because Kubernetes wouldn't be Kubernetes if it wasn't part of this bigger- If it wasn't given away, this wouldn't be here.
Yeah. Sometimes you got to set it free- Yeah ... to make it reach its destiny.
Anyway, where can people get more information? Well, you can reach out to me, Nick Ubartz. Just look for my name on socials.
It's not that common. And you can also, if you're still here, this is live, I'll be at the booth, but only for maybe another hour. But I'm going to imagine in the CNCF directory of- Oh, and the CNCF directory has information on all three projects that were released.
That's what I was looking for. 100%. All right.
I thought they wanted to hang out with me. Hey, you can hang out with Nick. He's going to be in Florida next week.
I'm not going to tell you where. I'm going to hang out. He's going to be at my house for Thanksgiving.
It'll be at his house. All right. All right.
Hey, we're wrapping up here at KubeCon. One more thing? I got one more thing.
What do you got? Look in the camera. Go ahead.
Knicks in five. Let's go. 53 years, I've been a Knicks fan.
You're my whole life. Well, your whole life, yeah. Yeah.
53 years. I wish I had my hat. I had my Knicks hat with me.
Oh, do you? New York or nowhere, Knicks, yeah. I didn't wear it today.
I wasn't going out. All right. Anyway, I appreciate you, man.
Yeah, very nice to meet you. I was watching the game on TV last night against Cleveland. They're good.
Oh, they look bad. Yeah, bad. This is earlier.
It's early. This is earlier. It's early.
Let's see. You don't need to watch this. Sorry, y'all.
It's all good. Hey, we're here at KubeCon. We're wrapping up.
So we'll be back with more in a minute.
