Tool
substrate
agent-substrate/substrate
What it is
A Kubernetes runtime that places agents and other workloads in gVisor or microVM sandboxes. It snapshots idle workloads out of memory and restores them on request, with an egress gateway and per-workload identity.
Who it might suit
Kubernetes operators who need to host large numbers of untrusted, mostly idle agent workloads and want idle ones snapshotted out of memory.
What to check first
The isolation and credential-handling claims are the project's own, so read its Security Guide and threat model. It needs a Kubernetes cluster, and the README notes extra kernel settings for hosts running over a thousand sandboxes.
How it runs
Kubernetes runtime
Written
