GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Agent Substrate
  • Docs
  • Examples
  • Community
  • GitHub

This view

  • Original page
  • New address

GeezerVison is showing ate.dev — Agent Substrate

Open source · Secure-by-default agent runtime Open source · Secure-by-default

Run millions of agents, securely.

Every agent runs in its own microVM or gVisor sandbox. Idle agents suspend, resume in under 500ms on any ready worker, and keep their memory and filesystem state.

Get started Watch the demo
$ kubectl ate create actor my-agent --template counter
Yolo, the Agent Substrate mascot
atespace / ate-demo
ACTORS 250 registered · 6 running · 1 resuming · 1 suspending
atenet router routes & resumes on request
READY WORKER PODS 8 warm pods · each hosts 1 active actor
worker-1
actor/counter-14 running in sandbox
worker-2
actor/claude-39 running in sandbox
worker-3
actor/sandbox-72 ↻ resuming · 284ms
worker-4
actor/adk-108 running in sandbox
worker-5
actor/mcp-143 ⏸ suspending state
worker-6
actor/hermes-176 running in sandbox
worker-7
actor/codex-204 running in sandbox
worker-8
actor/agent-231 running in sandbox
Actor state: Running Resuming Suspending Suspended (0 pods)
<500ms to resume a suspended actor on any ready worker
500+/s suspend and resume activations per second
10× higher density than standard container runtimes
2 isolation modes microVM and gVisor sandboxes, one lifecycle
ZERO TRUST FOR AGENTS

Every agent has an identity, but no credentials, no open network, and no escape from the sandbox.

Instead of sharing a process across users, Agent Substrate isolates every actor in its own single-tenant sandbox while multiplexing thousands of them across shared physical hosts.

Read the security principles
Identity
Distinct Workload Identity

Every actor gets a short-lived SPIFFE X.509 certificate and on-demand JWTs that are injected on egress and federate with every cloud provider and external service.

Authentication guide
No credentials
Zero Ambient Credentials

Actor sandboxes execute credential-free. The egress gateway pulls secrets from pluggable secret stores and injects API keys and tokens out-of-band on authorized outbound calls. The agent never holds a secret.

Credential injection
No open network
No Ingress or Egress by Default

Actors launch in isolated network namespaces with no inbound access, no peer-to-peer traffic, and no control-plane reachability. Inbound calls must authenticate at the router, and outbound traffic is blocked unless allowed by an egress policy.

Egress & network policies
No escape
Sandboxed Single-Tenant Actors

Give every user, session, or task its own dedicated Cloud Hypervisor microVM or gVisor sandbox with isolated compute, network, and storage. Local worker state is scrubbed between runs.

Security overview
HOW IT WORKS

Agents are idle most of the time. Stop paying for it.

Read the architecture
Actor Teleport

Suspend an actor and resume it on any available worker in the pool in under 500ms.

Suspend & resume
State Persistence

Memory and filesystem state survive hibernation through full-state snapshots, so actors pick up where they left off.

Snapshots
Agent Multiplexing

Pack a large registry of stateful actors onto a small pool of shared workers. The demo runs about 250 actors on 8.

WorkerPools

Runs on any Kubernetes 1.37+ cluster. Kubernetes handles nodes, autoscaling and recovery. Substrate's own control and data plane handle agent scheduling and suspend/resume, so the Kubernetes API stays off the request path.

GET STARTED

Manage actors with kubectl ate

# 1 · create an atespace, template, and actor
kubectl ate create atespace demo
kubectl ate create actor-template -f counter-template.yaml
kubectl ate create actor my-agent -a demo --template counter

# 2 · proxy to the actor & send a request (wakes on demand)
kubectl ate proxy actor my-agent -a demo &
curl -X POST http://localhost:8000/

# 3 · inspect state or suspend back to snapshot storage
kubectl ate get actor my-agent -a demo
kubectl ate suspend actor my-agent -a demo
Full quickstart guide
SEE IT RUN

~250 stateful actors, 8 physical pods

Actor teleport, state persistence, multiplexing YouTube
Counter demo Sandbox Claude Code multiplex Request parking All 7 examples →
FRAMEWORK AGNOSTIC

Bring any agent. It is just an OCI container.

An actor is a standard OCI container whose memory and filesystem persist across requests. Package an entire agent runtime inside an actor so it suspends when idle and resumes, or connect an external agent platform to execute untrusted code and tools inside isolated actor sandboxes.

Agent Development Kit LangChain Claude Code Codex Hermes OpenClaw Antigravity MCP servers
BUILT ON SUBSTRATE Agent Executor A distributed agent runtime: a secure, hyper-scalable agent harness on Agent Substrate.
BUILT ON SUBSTRATE · CNCF SANDBOX kagent A Kubernetes-native framework that runs sandboxed, stateful agent workloads on Agent Substrate.

Build it with us

Community meeting every Thursday, 10–11am PT.
CNCF Slack #substrate-users · #substrate-dev Mailing list ate-dev on Google Groups Contribute Start with the contributing guide
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.