NVIDIA and Google Hand Their Agent Infrastructure to the CNCF: OpenShell, Agent Substrate, gVisor and OpenRL All Join the Sandbox

At KubeCon + CloudNativeCon North America in Salt Lake City on November 10, the two companies building most of the plumbing beneath commercial AI agents agreed to stop owning it alone. NVIDIA donated OpenShell, its secure runtime for autonomous agents, to the Cloud Native Computing Foundation, and Google placed Agent Substrate, gVisor and OpenRL into the CNCF Sandbox — the foundation's entry tier for vendor-neutral, community-governed projects.

OpenShell is the governance piece. Spearheaded by NVIDIA, it controls how agents execute: which resources and data they can touch, where inference requests route, and what policy gets enforced in the infrastructure around an agent rather than inside the model. NVIDIA says the project has been in production for less than a year and is already used by hundreds of organizations, with tens of thousands of contributions — a company-reported figure. "Handing OpenShell to the community gives developers a common foundation and a chance to shape how agent security evolves," said Jim Zemlin, executive director of the Linux Foundation, CNCF's parent.

Google's Agent Substrate, accepted into the Sandbox alongside it, is the runtime economics piece: a zero-trust framework for executing agents on Kubernetes while isolating untrusted code. Google says it can run millions of sandboxes at ten times the density of standard container runtimes, sustain more than 500 suspend-and-resume activations per second, and restore a paused session in under 500 milliseconds — because the agent's identity and state are separated from the compute executing it, and idle agents release their hardware. The project reached version 1.0, generally available on GKE, with more than 100 contributors since public development began in May 2026. NVIDIA is already working to pair it with its Dynamo inference framework and KAI Scheduler.

The most consequential donation may be the oldest one. gVisor, which Google first open-sourced in 2018, intercepts system calls in userspace so container code never talks directly to the host Linux kernel — the property that makes it safe to run agents that generate their own shell commands and install unreviewed packages. Google says it already runs millions of gVisor sandboxes a day inside GKE Sandbox and Cloud Run, and it named Anthropic, OpenAI, Modal, Snowflake, Ant Group and Tencent as external users. Ant Group, Modal and Tines have committed to join the maintainer team, with OpenAI, Tencent and Nvidia continuing as contributors.

The fourth project, OpenRL, covers the training side: Kubernetes-native orchestration for reinforcement-learning post-training, coordinating model sampling, outcome evaluation and weight updates across shared accelerator pools. It began as a research preview in February and supports PyTorch and vLLM, with Gemma and Qwen validated out of the box, and it is designed to pair with llm-d — the distributed-inference project backed by Red Hat, Google Cloud, IBM Research, CoreWeave and NVIDIA that also joined the CNCF this year.

The broader numbers frame how fast this niche consolidated. CNCF's portfolio now spans 231 projects; the global cloud-native developer population reached 21.2 million; and the foundation's events drew 82,000 attendees across more than 50 countries in the past year. Eight companies upgraded to Platinum membership in one go: Adyen, Broadcom, CoreWeave, CVS, HAProxy, NVIDIA, OVHcloud and Vultr. "A year ago, we were talking about the opportunity in inference," said CNCF executive director Jonathan Bryce. "Today, this community is building the infrastructure to train models, run inference and put agents to work with the security and scale production demands."

NVIDIA also used the show to extend its own stack, announcing three new components for its DSX AI Factory platform: NVIDIA Kubernetes Engine and Kubernetes Recipes, both in public preview, plus Snapshot, which restores checkpoint copies in seconds for inference scaling and failure recovery.

The pattern repeating here is the one that made Kubernetes itself: when a layer becomes something every competitor needs but none can afford to fork, it migrates to neutral ground. The labs will keep competing on models. The sandboxing, scheduling and policy enforcement underneath them — the parts that decide whether an agent is safe to run at all — are now, formally, everyone's problem.