SALT LAKE CITY – Agent sandboxes hogged the spotlight during Day 1 at KubeCon North America here this week, continuing a growing convergence between agent governance and infrastructure.
Keynotes kicked off Tuesday morning with the acceptance of two projects founded by large vendors into the Cloud Native Computing Foundation (CNCF): Nvidia's OpenShell and Google's Agent Substrate. Both projects have gained momentum over the past year, with 380 contributing organizations to OpenShell since its first commit in January and 164 contributing organizations to Agent Substrate since its first commit in May.
It's natural and important to bring these tools under the same vendor-neutral governance as the cloud-native Kubernetes infrastructure where they run, according to one Nvidia official. They both target self-managed AI deployments at security-conscious companies.
"We can't simply ask agents to follow the rules; the infrastructure must enforce them," said Justin Boitano, vice president of enterprise AI at Nvidia, in a video keynote presentation. "AI agents have become part of cloud-native infrastructure. The technology that secures them should be open, vendor-neutral and governed by this community."
OpenShell emerged amid concerns about agents, notably the OpenClaw personal agent, escaping containment mechanisms earlier this year. OpenShell has built rings of infrastructure isolation around agents, beginning with a hardened container and extending to microVMs, which emulate the nimble performance of containers while providing operating-system isolation. Ultimately, Nvidia supplemented OpenShell with Sentry, a hardware-based policy enforcement layer that runs on its BlueField-4 data processing units.
Agent Substrate, contributed to CNCF by Google last week, takes things a step further. The project isolates agent workloads using microVMs, such as Google's gVisor, but it also changes how the underlying infrastructure is provisioned to pack more agents into each Kubernetes pod and node. It does so using a construct called Actors, which represent individual agent sessions much smaller than containers or pods. Actors can also be ephemeral; Agent Substrate stores snapshots of each microVM that can fall dormant but quickly "wake up" when called upon.
The project's goal wasn't just to achieve agent isolation but to improve the efficiency and resilience of the overall infrastructure, according to a blog post last month by Michael Levan, principal AI architect at Solo.io, a founding contributor to Agent Substrate, along with Nvidia and Microsoft.
"OpenShell, although it has some scalability within its implementation, focuses primarily on policy and governance needs. This is, of course, incredibly important, but the key with Agent Substrate … is that policy and governance is table stakes," Levan wrote.
Redefining resilience for the AI era
For one enterprise early adopter, Agent Substrate will serve as a way to secure both AI and nonAI workloads while efficiently supporting AI agents for 1,500 employees on-premises.
"Substrate particularly interested us … because of the price of compute," said Andrew Boswell, head of IT at Swissquote, a financial services company based in Geneva, Switzerland. "The idea of pausing workloads that then resume [means] we're able to use our own hardware at much higher density than we would have otherwise."
Agent Substrate represents a natural evolution of the cloud-native infrastructure tools Swissquote already uses, Boswell said. Digital sovereignty concerns also make it crucial to use vendor-neutral, internally managed tools that offer flexibility across various infrastructure providers, if necessary, alongside the company's internal data center infrastructure.
"For us, it was really important to own the stack [but] have things that allow us to use others if we need to," he said. "Agent substrate is part of the layer cake that we set out to build when we were thinking about, 'Do we use pure open source software and build on top of it, or do we buy?'"
Ultimately, sovereignty and security depend not just on hardened layers of execution but on the ability to build independence and resiliency into infrastructure that can evolve as needs change, Boswell said.
"We have a way to keep running things internally, even if models disappear outside, or if, for instance, there are geopolitical events that mean that you're cut off from certain models or providers, which happened with [Anthropic's] Fable, for instance," he said. "Does everything need to be on-prem? Probably not, but it's important to have that strategic optionality where it's needed and where it's appropriate."
Infrastructure and security tools and teams are converging
This news continues a growing trend toward anchoring agent security in infrastructure tools, including the OpenShell Reference Architecture, launched last month with pledged support from enterprise AI factory makers Red Hat, Dell and HPE. That reference architecture pairs OpenShell's software-based agent isolation mechanisms with Sentry, a utility that runs at the hardware layer on Nvidia BlueField-4 Data Processing Units.
Also last month, IBM integrated OpenShell and Sentry into its Fusion AI Factory and rolled out HashiCorp Vault Enterprise 2.2, which supports on-premises application startup authentication using a virtual machine called a trusted platform module.
Within enterprises, AI governance is also driving convergence between infrastructure and operations (I&O) and security operations teams, according to a September Gartner report.
"AI risks increasingly impact infrastructure, which include securing access to GenAI applications with prompt and response inspection, protecting against the compromising of AI supply chains impacting AI workflows and preventing jailbreak attacks through prompt injection," according to the report. "AI capabilities such as agentic NetOps are increasingly included in tooling that is accelerating the convergence of I&O and security functions with shared telemetry."
The nexus between security and infrastructure efficiency concerns emerged during the OpenClaw craze earlier this year, which also prompted questions about how to isolate agents without cost-prohibitive infrastructure requirements, said CNCF CTO Chris Aniszczyk, during a press conference here this week.
"When OpenClaw first came out … Mac Minis were sold out all over the world," Aniszczyk said. "But that agent, even though it's long-running, even though it may do work arbitrarily day or night, it's not necessarily using that Mac Mini at 100% of the capacity over that time. … As we see the shift to long-running agents that are hosted in data centers, which is where a lot of enterprises and even SaaS products are going now, that ability to have efficient scaling is really, really important."
OpenShell, Substrate overlap, but could be complementary
Nvidia is a contributor to both projects and indicated in a company blog post this week that it plans to work with Google to integrate the two. OpenShell binds agent access controls to infrastructure nodes, while Google's Agent Substrate combines runtime isolation with multinode orchestration on shared Kubernetes clusters.
It's unclear exactly how the two would reconcile their architectural differences, but they have differing priorities, according to a LinkedIn post last month by Boris Renski, CEO of HyperShell, a contributor to OpenShell which markets commercial platform support for the project.
Renski posted a diagram comparing the primary and secondary focus areas for each project. For Agent Substrate, primary concerns include flexible infrastructure provisioning and governing agents' access to code repositories, MCP servers and skills. OpenShell, on the other hand, places more emphasis on controlling individual API and tool operations, managing access to credentials and proving that access policies aren't accidentally permissive – all items Renski characterized as emerging, limited or absent from Agent Substrate.
"Despite starting with different angles … both are increasingly converging with growing overlap," Renski wrote. "In the end, the dominant platform will be the one with broadest adoption."
Beth Pariseau, lead editor for infrastructure news at TechTarget, is an award-winning veteran of IT journalism. Have a tip? Email her or connect on LinkedIn.
