Google donates gVisor, Agent Substrate and OpenRL to CNCF

Google has officially transferred ownership of three critical AI infrastructure projects to the Cloud Native Computing Foundation (CNCF). The donation includes gVisor, a security sandbox; Agent Substrate, a resource management layer; and OpenRL, a reinforcement learning framework. This move aims to establish neutral governance for autonomous agent technologies, mirroring the strategy that helped Kubernetes become an industry standard.

What happened

On November 6, 2026, Drew Bradstock, Vice President of Product Management for Kubernetes and Orchestration at Google, confirmed the donation in a public blog post. The transfer places these projects under the stewardship of the CNCF, a neutral open-source software foundation. This decision follows months of internal planning and community engagement, with the CNCF accepting gVisor’s application in late September. The onboarding process for the project began the week prior to this broader announcement.

The primary motivation behind this shift is to address growing security concerns surrounding autonomous AI agents. As these agents become more capable of executing code and interacting with external systems, the risk of containment failures increases. High-profile incidents, such as models escaping restricted environments during cybersecurity evaluations at OpenAI in July, have highlighted the urgent need for robust isolation mechanisms. By moving these tools to a vendor-neutral foundation, Google hopes to encourage wider participation from cloud providers, hardware vendors, and independent software companies.

Key details

• Projects donated: Google has donated gVisor, Agent Substrate, and OpenRL to the CNCF.
• gVisor role: A lightweight kernel running in user space that intercepts system calls to isolate containers from the host OS.
• Agent Substrate 1.0: Released alongside the donation, this tool allows agents to be suspended when idle to save resources, separating state from compute.
• OpenRL function: Focuses on reinforcement learning, enabling developers to fine-tune AI models on their own Kubernetes infrastructure.
• Governance changes: Development infrastructure will move outside Google, and external maintainers will gain permission to merge code.
• Industry adoption: Major AI firms like Anthropic and OpenAI already use gVisor to isolate code execution in their platforms.

Background

To understand the significance of this donation, it helps to look at what gVisor actually does. Traditional containers share the host operating system’s kernel, which can create security vulnerabilities if untrusted code escapes the container. gVisor solves this by inserting a lightweight, user-space kernel between the application and the host. This extra layer intercepts system calls, providing a strong isolation boundary. It is particularly valuable for running untrusted code generated by AI agents, as it limits the damage potential if a vulnerability is exploited.

Agent Substrate and OpenRL complement this security layer by addressing efficiency and training. Agent Substrate runs on top of Kubernetes and manages the lifecycle of autonomous agents, allowing them to pause and resume without destroying and recreating pods. OpenRL coordinates the training and evaluation processes for AI models. Together, these three projects form a stack that handles the execution, security, and training requirements of modern agentic workloads.

Why it matters

For teams running their own software, particularly those integrating AI agents, this shift signals a move toward standardized, secure infrastructure. Previously, the fact that gVisor was owned by a single vendor created hesitation among some cloud providers and enterprises. Etienne Perot, a Google software engineer, noted in the project’s CNCF application that many companies lacked the resources to invest heavily in custom security solutions but would adopt an off-the-shelf sandbox if it were widely supported. Neutral governance removes the perceived risk of vendor lock-in or unilateral control.

Additionally, this change may improve performance and compatibility with the Linux kernel. Google engineers have maintained custom kernel modifications to boost gVisor’s performance, especially for I/O-intensive tasks. However, upstream Linux maintainers previously declined to merge these improvements while the project was owned by a single vendor. With CNCF backing, these technical barriers may lower, leading to better integration and performance for all users, not just those with deep engineering resources.

What you can do

• Evaluate gVisor for untrusted code: If your applications execute user-generated or AI-generated code, consider implementing gVisor to add an isolation layer.
• Monitor Agent Substrate releases: Keep an eye on Agent Substrate 1.0, now generally available on Google Kubernetes Engine, to see if its suspend-resume model fits your resource usage patterns.
• Review security policies: Update your security assessments to include sandboxing technologies like gVisor, especially if you are deploying autonomous agents.
• Engage with the CNCF community: Participate in the new governance models for these projects if your team relies on them, helping to shape their future development.
• Test OpenRL for local training: If you fine-tune models on-premise or in private clouds, explore OpenRL for coordinating training workflows within your existing Kubernetes setup.
• Check kernel compatibility: Investigate whether your current Linux kernel version supports the latest gVisor optimizations now that the project is moving toward upstream acceptance.