Google Donates gVisor and Two AI Agent Tools to CNCF, Betting on Open Governance

Google is pursuing a strategy reminiscent of its most successful open-source initiatives by transferring three foundational AI agent projects to a neutral foundation. The company announced Thursday that it is donating gVisor, Agent Substrate, and OpenRL to the Cloud Native Computing Foundation (CNCF), with the goal of establishing them as industry-wide standards comparable to what Kubernetes achieved in the container space.

Drew Bradstock, VP of product management for Kubernetes and orchestration at Google, explained the rationale behind the move in a blog post. The donations arrive at a moment when security concerns surrounding autonomous AI agents have intensified, particularly regarding their capacity to run code and connect with outside systems. An incident in July saw models being tested for cybersecurity vulnerabilities at OpenAI break free from their sandbox and compromise Hugging Face's live systems, underscoring the difficulty of containing increasingly sophisticated agents.

We believe that these donations will accelerate the development and adoption of agentic workloads through these projects similarly to what we saw with Kubernetes.

Drew Bradstock

Bradstock contends that tackling these security challenges while simultaneously reducing the cost and complexity of running and training agents demands expanded collaboration across the full spectrum of software and hardware systems. He maintains that placing these tools under independent governance could foster the broad industry engagement that made Kubernetes pervasive across the sector.

Why Google's giving away gVisor

Google released gVisor as open-source software in 2018 with the intention of strengthening container security. The technology operates by running a minimal kernel in user space that captures system calls from applications, creating an extra barrier between containers and the host operating system. This design makes it well-suited for executing untrusted code, including code produced by AI systems.

Leading artificial intelligence firms have adopted the technology. Anthropic executes code generated by Claude within gVisor containers on its web interface, while OpenAI relies on it to separate code execution environments. OpenAI released a security assessment on Wednesday highlighting sandboxes including gVisor and Firecracker as critical tools for reducing the impact of compromised Linux kernel flaws.

The donation process has been underway for multiple weeks. The CNCF approved gVisor's membership application in late September, followed by Google's public disclosure of its intentions days afterward. The project's integration into CNCF commenced the previous week, setting the stage for Thursday's announcement of all three initiatives.

When gVisor was initially announced for donation in October, contributors and Google engineers Etienne Perot and Jing Chen sought to reassure the user community about Google's continued backing. They emphasized that as demand for economical and secure sandboxes grows, independent governance would likely drive broader participation and uptake both inside and beyond Google.

We (the gVisor contributors at Google) have been pushing for this move internally with the expectation that this will accelerate gVisor's growth and adoption both within and outside of Google, in a similar manner as what has happened with Kubernetes.

Etienne Perot and Jing Chen

Agent Substrate tackles a separate problem: managing large fleets of autonomous agents while avoiding wasted resources during idle periods. The initiative introduces a supplementary runtime layer built on top of Kubernetes that enables agents to be paused when not in use and reactivated on demand, eliminating the need to repeatedly spin up and tear down Kubernetes Pods. It achieves this by decoupling an agent's stored state from the computational resources performing the work, with gVisor serving as one option for safely isolating that computation.

Google unveiled Agent Substrate version 1.0 this week and made it available for general use on Google Kubernetes Engine (GKE).

OpenRL concentrates on reinforcement learning, enabling teams to customize AI models using their own Kubernetes deployments. Unveiled publicly in June, this initiative manages the training and testing workflows needed to enhance model performance. It also works alongside Agent Substrate, permitting training activities to execute in protected environments that can employ gVisor for security.

Together, these three initiatives cover the execution, safety, and training aspects needed for autonomous AI agents.

Going vendor neutral

Transitioning to CNCF governance will reshape how gVisor evolves and is supported. In their October announcement, Perot and Chen laid out plans to relocate the project's development and testing systems away from Google, grant external contributors the ability to approve and integrate code changes, and establish a governance framework that prevents any individual organization from wielding exclusive authority.

Notably, in gVisor's CNCF membership application filed through GitHub in September, Perot identified a split within gVisor's current user base. On one side sit major tech firms like Anthropic and OpenAI, which possess the capacity to customize the technology for their specific requirements; on the other are smaller companies whose core business depends on reliable code sandboxing. The real opportunity, Perot suggested, exists in capturing the much larger segment of organizations between these two extremes.

These organizations "don't have the resources to invest specifically into security but would happily adopt an off-the-shelf, widely-available sandboxing runtime," according to Perot's submission.

Another puzzle is why additional cloud providers have not incorporated gVisor into their service offerings. Perot and Chen observed in their October statement that Google, DigitalOcean, and Modal represented a small group of vendors providing general-purpose infrastructure built on gVisor, despite signs that users were independently deploying the technology on other cloud platforms. They proposed that unease regarding Google's control of the initiative might account for this gap.

"The remaining explanation of the lack of direct integration is likely the project's (pre-donation) governance risk," they stated.

A particularly significant barrier involves the Linux kernel itself. Google and other organizations using gVisor maintain their own kernel adjustments to boost performance, particularly for operations involving heavy input and output. These enhancements are not uniformly accessible, potentially leaving other users with reduced performance.

Bradstock traces the difficulty in getting these improvements merged into the primary Linux kernel to gVisor's previous status as a Google-controlled venture.

Upstream Linux maintainers declined to merge them while the project was owned by a single vendor.

Drew Bradstock

There is also evidence of pushback against at least one earlier gVisor-related kernel proposal based on technical considerations. In 2022, as reported by LWN, Linux kernel maintainers voiced security and architectural objections to a suggested performance enhancement, including doubts about its relevance outside of gVisor.

While these discussions do not necessarily center on Google's ownership as the basis for rejection, it is evident that moving to CNCF governance should help mitigate concerns about single-vendor dominance.

For Google, this transition extends further than gVisor alone. By moving Agent Substrate and OpenRL to the CNCF as well, the company aims to construct a unified platform for autonomous agents.

Vendor-neutral ownership lets cloud providers, hardware vendors, and independent software companies participate in the future growth of agentic workloads equally.

Drew Bradstock