proomt

Search

Search posts, papers, and topics

All posts

Google Cloud BlogAlex Zakonov6 min readintermediate

Agent Substrate brings high-density, scalable, trusted infrastructure to GKE

Read on google.com

Summary

Agent Substrate is an open‑source runtime for AI agents that runs on GKE. It uses Cloud Hypervisor microVMs or gVisor sandboxes to give kernel‑level isolation, a custom control‑ and data‑plane that can suspend/resume agents in <500 ms, and a “zero‑idle” model that packs >1 000 dormant agents per host (≈10× density vs. containers). GKE integration adds custom ComputeClasses, spot/on‑demand pools,…

  • Secure‑by‑default isolation via hardware‑isolated microVMs or gVisor, plus an egress/ingress gateway for fine‑grained network policies.
  • Sub‑second activation: pre‑warmed workers enable <500 ms resume and hundreds of suspend/resume cycles per second.
  • Active‑only compute economics: idle agents are snapshotted to local disk/Cloud Storage, freeing RAM/CPU; >1 000 dormant agents per host → ~10× higher compute density.
  • Kubernetes remains the control plane for node health, autoscaling, and multi‑zone scheduling; the agent‑native data plane handles fast suspend/resume.

Running large fleets of autonomous AI agents requires both strong isolation (to prevent code‑escape) and efficient resource use (agents spend most of their time idle). Agent Substrate’s snapshot‑based suspend/resume and kernel‑level sandboxing aim to make million‑agent scale feasible on standard Ku…

5/10
securitycloudperformanceai agentskubernetesgke

Related reading

  1. For SeaVerse, GKE Agent Sandbox reduces infrastructure costs by 60%

    SeaVerse uses GKE Agent Sandbox (Kata Containers + Cloudhypervisor or gVisor) to run isolated AI sandboxes at scale, achieving 300 allocations / s per cluster (90% ≤ 200 ms) and cutting infrastructure spend by up to 60% via flexible VM sizing and per‑sandbox persistent storage, while gaining native Cloud observability.

    Google Cloud Bloggoogle.com5 min

  2. Introducing Filestore agent volumes: fully managed storage for agent workspaces

    Google Cloud adds Filestore agent volumes, a fully‑managed, elastic file‑system that automatically provisions isolated POSIX workspaces for GKE‑based AI agent sandboxes. Volumes attach in milliseconds, support RWX with file‑level locking, and charge only for used capacity with automatic tiering, aiming to cut cold‑start latency and storage waste for large‑scale agent fleets.

    Google Cloud Bloggoogle.com4 min

  5. Agent Anomaly Detection, now in Private Preview on the Gemini Enterprise Agent Platform

    Google’s Gemini Enterprise Agent Platform now offers a private‑preview Agent Anomaly Detection service that asynchronously analyzes agents’ OpenTelemetry traces and logs to flag risky behavior (e.g., tool misuse, privilege abuse) without adding latency, surfacing findings in Security Command Center and via an API for automated mitigation.

    Google Developersgoogleblog.com4 min

  6. The DevFest Community Workshop Experience: Building Real Agents Together

    Google’s DevFest Community Workshop introduced a “Workbench” format that emphasizes architectural mental models over copy‑paste code, guiding engineers to build long‑running, self‑evolving multi‑agent systems with the Agent Development Kit and Gemini Enterprise platforms. Attendees learned state‑separation, workflow pausing, and self‑patching pipelines, and the series will continue in five more c…

    Google Cloud Bloggoogle.com2 min