Report

Agent Substrate: From Pods to Sandboxes

Chapter 1 preview: why AI agents strain Kubernetes, and how Agent Substrate runs them at scale.

Running a few AI agents on Kubernetes is easy. Running tens of thousands of them, with only a few hundred active at a time, is not. If every agent gets its own Pod, costs climb, sessions are slow to start and access control gets harder. In Chapter 1, Christian Posta explains where Kubernetes starts to struggle with agent workloads and how Agent Substrate solves it.

What you’ll learn

Why idle Pods, Pod-level identity and slow startup times strain Kubernetes under agent workloads
How Agent Substrate’s Actors and Workers separate an agent’s session from the compute running it
What an execution layer needs to provide: fast suspend and resume, sandbox isolation and an identity for each session
When to use Substrate, and when a standard Deployment is enough

The full book launches on November 10, 2026, at KubeCon + CloudNativeCon North America. Get a free printed copy at Solo.io Booth 121, or download the full PDF on solo.io after November 10.

Agent Substrate: From Pods to Sandboxes

Chapter 1 preview: why AI agents strain Kubernetes, and how Agent Substrate runs them at scale.

Download now

Additional Resources

New Projects, AI Agents, and a Very Long Book Signing Line: AGNTCon + MCPCon

The Role of Virtual MCP in Managing LLM Costs

What 'is' Agent Identity? Human? Workload? A new Layer?

Interview with James Quigley on Istio Ambient at KCD NY

kagent <3 Agent Substrate: A 101 installation & Configuration Guide

Solo Enterprise for Istio 1.30: Agentic Mesh, ztunnel-Native Egress, New UI, and Fine-Grained Workload Identity

Agentgateway Code Mode for OpenAPI to MCP

From Service Mesh to Agentic Mesh

Keeping Context and Tokens Low With Progressive Disclosure In Agentgateway

MCP Progressive Disclosure: Save Tokens, Retrieve Schemas

Five Minutes to Your First MCP Server Tool: A Quickstart with agentgateway

Agentic Quality Benchmarking With Agentevals

The AppMesh Migration Playbook

Solo Enterprise for Istio 1.29: ECS Now GA, Enhanced Debuggability, and Flexible Global Service Aliasing

Your First AI Route: Connecting to OpenAI with AgentGateway

Getting started with Multi-LLM provider routing

What Comes After Ingress NGINX? A Migration Guide to Gateway API

Why Traditional Gateways Failed AI Workloads - and How Kgateway's Rust-powered Agentgateway Fixes It

Context-aware Security for Agentic AI Gateways

Kgateway: The Best Alternative for Ingress NGINX

The Linux Foundation’s new Agentic AI Foundation and Secure MCP Infrastructure

Security Holes in MCP Servers and How To Plug Them

Announcing Solo Enterprise for Istio Support for Amazon ECS

Gloo Mesh 2.11: Expands Support to Amazon ECS and Brings Multi-Tenant Flexibility to Enterprises.

Reducing the costs and complexity of your cloud native architecture with Ambient Mesh

Introducing Solo Enterprise for agentgateway

Ambient mesh deployments made easy with Gloo Operator

Choosing between installation methods in Gloo Mesh: Helm vs. the Gloo Operator

How ambient mesh challenges the security gaps in sidecar workloads

Migrating from sidecars to ambient with zero downtime

Comparing Istio's ambient multicluster support with Gloo Mesh's multicluster peering

The future of Kubernetes is context-aware: Meet Solo Enterprise for kagent

kgateway as Ingress for Ambient Service Mesh

Tracing GenAI Applications Is Not Enough

Gloo Mesh 2.10: More Secure, Scalable Cloud Connectivity

MCP Authorization is a Non-Starter for Enterprise

Securing and Observing Your Services, Simplified

From MCP Servers to Services: Introducing kmcp for Enterprise-Grade MCP Development

The Power of a Single API to Secure, Observe, and Control Traffic in All Directions

Why Building Large Kubernetes Clusters Is (Still) a Bad Idea

Fortifying Your Cloud Native Connectivity Security Posture with Solo and Ambient Mesh

Migrating from Sidecars to Ambient Mesh - Risks, Challenges, and Benefits

Overhaul of Agent Gateway supporting A2A, MCP, and Kubernetes Gateway API

How Ambient Mesh Delivers Advanced Resource and Cost Savings

Getting Started with Ambient Mesh: From 0 to 100 mph

Agent Discovery, Naming, and Resolution - the Missing Pieces to A2A

Part Two: MCP Authorization The Hard Way

Part One: MCP Authorization The Hard Way

Agent Identity and Access Management - Can SPIFFE Work?

Deep Dive into llm-d and Distributed Inference

Motive

Confluent

Ingenico

OfferUp

ParkMobile

Vonage

Domino’s Pizza

Introducing Solo Enterprise for agentgateway

Comparing Sidecars with Sidecarless Mesh Implementation

Solo Enterprise for Istio Feature Comparison

Enterprise Support for Istio in Production

Service Mesh for Developers, Part 1: Exploring the Power of Observability and OpenTelemetry

Service Mesh at Scale

Compare Capabilities of the Top Service Mesh Platforms

Compare Capabilities of the Top API Gateways

Establishing zero trust security for modern cloud architectures

Unlocking the Power of Your API Gateway

API Gateways: Productivity, Resilience, and Security for Next-Generation Cloud Applications

Driving Business Value with Istio

Service Mesh Vendor Comparison

Istio Then & Now

4 Reasons Why You Need an AI Gateway

Solo Enterprise for kgateway vs. Kong

Solo Enterprise for kgateway vs. Apigee

3 Reasons You Need an API Gateway for Microservices Apps

Run Sandboxed Agents with kagent and Agent Substrate