CNCF: Isolation. Security. Scale.
The CNCF blog post explains agent sandboxing and describes Agent Substrate, which runs agents as Actors inside Workers (Pods) managed by a control plane, using gVisor for software-level isolation and microVMs for hardware-level isolation. It walks through installing kagent and Agent Substrate with Helm, declaratively creating a Harness and AgentTemplate, and running a sandboxed assistant. The post says an Actor runs only while a session is active.
What changes for platform teams
A platform team running kagent can provision agent sandboxes as declarative resources and keep agent sessions isolated from the host kernel, with the sandbox runtime chosen per workload. Teams should check the post's setup steps against current kagent and Agent Substrate releases before relying on them, since the post's own install steps are linked out rather than shown.
Read the original at CNCF Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules