Kagent v1.0 and Agent Substrate introduce a dedicated sandbox for running AI agents on Kubernetes, replacing ad‑hoc container isolation with enforced software‑level (gVisor) and hardware‑level (microVM) boundaries. Practitioners care because the model provides clear policy enforcement, reduces the risk of a compromised agent affecting the host, and guarantees that agents remain reachable when needed.
How the New Sandbox Is Built
Agent Substrate runs each agent inside a Worker pod that is managed by the ateapi control plane. The pod is wrapped by gVisor, which intercepts system calls in user space via the Sentry component, providing software isolation without a full hypervisor. For hardware isolation, the workload is launched inside a microVM that uses the host’s virtualization extensions, giving each agent its own minimal guest OS. This dual‑layer approach satisfies the requirement to isolate agents at both the kernel and CPU levels.
Deploying Agents with Kagent CRDs
Kagent supplies custom resource definitions (CRDs) that let you declare agents and reusable templates. A typical deployment creates a Harness (the running agent) and an AgentTemplate that stores configuration such as model settings and snapshot policies. The Helm chart for Kagent creates a default WorkerPool with two workers, and the substrateWorkerPool.create=true flag enables the Substrate integration.
apiVersion: kagent.dev/v1alpha3
kind: Harness
metadata:
name: kagent
namespace: kagent
spec:
kagent: {}
workload:
image: PATH_TO_YOUR_AGENT_IMAGE
substrate:
workerPoolRef:
name: kagent-default
snapshotPolicy:
location: gs://ate-snapshots-PATH_TO_YOUR_SNAPSHOTS
---
apiVersion: kagent.dev/v1alpha3
kind: AgentTemplate
metadata:
name: assistant
namespace: kagent
labels:
kagent.dev/harness: kagent
spec:
modelConfig:
name: default-model-config
description: A substrate‑backed assistant used to verify this main build.
systemPrompt: ""
Applying the manifest with kubectl apply -f - creates the sandboxed agent and registers it with the Substrate control plane. The snapshot policy points to a Cloud Storage bucket, enabling stateful resume after restarts.
Operational and Security Considerations
From an operations perspective, teams must provision the underlying microVM resources and monitor the gVisor overhead, as both add latency compared to a plain container. Snapshot storage introduces a dependency on external object storage; retention and access controls for the bucket become part of the agent’s security posture. Network policies still apply at the pod level, but the sandbox ensures that an untrusted agent cannot escape its namespace or hypervisor boundary.
Security engineers should treat the gVisor and microVM layers as isolation mechanisms rather than full authorization controls. Policy enforcement for inbound and outbound traffic remains the responsibility of the AI gateway or surrounding service mesh. Multi‑tenant environments benefit from the built‑in boundary between workers, but careful labeling and RBAC on the CRDs are required to prevent cross‑tenant manipulation of AgentTemplate objects.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Adopting Kagent with Agent Substrate gives you a repeatable pattern for running agents that isolates code, enforces policy, and supports snapshot‑based recovery. Evaluate the performance impact of gVisor and microVM on your workloads, size your WorkerPool to match expected concurrency, and align snapshot storage permissions with your data‑handling policies. Monitoring the health of the control plane (ateapi) and the underlying microVM hosts will be essential to maintain availability in production.
