# Agent Substrate > Agent Substrate is an open source, secure-by-default agent execution runtime that runs millions of sandboxed agents (microVMs and gVisor) at up to 10x higher density than standard container runtimes. It runs on Kubernetes, which manages the machines, while its own control and data plane handle sub-500ms suspend and resume. Agent Substrate decouples the logical **Actor** (a stateful agent or workload instance addressed by `(atespace, name)` and instantiated from an `ActorTemplate`) from the physical **Worker** (a pre-warmed Kubernetes Pod in a `WorkerPool`). Idle actors are checkpointed to object storage (GCS or S3) and evicted from compute; when a request arrives with the `ate-target-actor: /` header, the Substrate router (`atenet`) and control plane (`ate-api-server`) assign a ready worker and the node-level supervisor (`atelet`) coordinates with the in-pod sandbox herder (`ateom`) to restore the actor's memory and filesystem state in under 500ms—bypassing the Kubernetes control plane on the request path. ## Consolidated Reference Bundle - [Full Documentation Bundle (llms-full.txt)](https://ate.dev/llms-full.txt): Single-file compilation of all Agent Substrate conceptual, architecture, how-to, CLI reference, API, and security documentation for AI context windows. ## Get Started - [Overview](https://ate.dev/docs/get-started/overview/): A high-density, low-latency execution runtime for stateful agent workloads. - [Quickstart & Installation](https://ate.dev/docs/get-started/quickstart/): Deploy Agent Substrate on a local Kind cluster and invoke your first stateful actor. ## Concepts - [Architecture](https://ate.dev/docs/concepts/architecture/): The components of Agent Substrate and how actors, workers, and the control plane interact. - [Request Parking](https://ate.dev/docs/concepts/request-parking/): How the atenet router holds requests for suspended actors while they resume. ## Tutorials - [Stateful Counter](https://ate.dev/docs/tutorials/counter/): Preserve in-memory and durable volume state across actor suspend and resume cycles. - [Interactive Sandbox](https://ate.dev/docs/tutorials/sandbox/): Execute interactive shell commands inside an isolated Alpine container with stateful snapshots. - [Jupyter Notebook](https://ate.dev/docs/tutorials/jupyter/): Run an unmodified Jupyter Notebook container that suspends when idle and resumes on browser access. - [Multi-Template WorkerPool](https://ate.dev/docs/tutorials/multi-template/): Share a single WorkerPool across multiple ActorTemplates and atespaces using label selectors. - [Request Parking](https://ate.dev/docs/tutorials/parking/): Hold and retry inbound requests during momentary WorkerPool saturation instead of failing with 503. - [Pluggable Egress Networking](https://ate.dev/docs/tutorials/egress/): Tunnel and authenticate outbound actor traffic over mTLS using Envoy or agentgateway. - [Claude Code Multiplexing](https://ate.dev/docs/tutorials/claude-code-multiplex/): Multiplex three Claude Code agents onto two worker pods with automatic suspend and resume. ## How-to Guides - [Operator Install](https://ate.dev/docs/guides/operator-install/): Configure the installer with a settings document, and how it resolves flags, environment, and config. - [Database Configuration](https://ate.dev/docs/guides/postgres/): PostgreSQL roles and connections for the bundled database and for bring-your-own databases. - [Authentication](https://ate.dev/docs/guides/authentication/): How clients authenticate to ate-api. - [Authorization](https://ate.dev/docs/guides/authorization/): How ate-api checks every call against an OpenFGA model, and how to manage roles and access. - [CSI Volumes](https://ate.dev/docs/guides/csi-volumes/): Attach CSI volumes to actors. - [Deploying CSI Drivers](https://ate.dev/docs/guides/csi-deployment/): Deploy CSI drivers for use with Agent Substrate. - [Egress Traffic](https://ate.dev/docs/guides/egress-traffic/): Supported outbound actor protocols, DNS relay filtering, and what actors see when egress is refused. - [Network Egress](https://ate.dev/docs/guides/network-egress/): How atunnel and the egress gateway tunnel, authenticate, and apply policy to outbound actor traffic. - [MITM Egress Interception](https://ate.dev/docs/guides/egress-trust-bundle/): Configure actors to trust the egress gateway's MITM CA for HTTPS header and credential injection. - [Egress Credential Injection](https://ate.dev/docs/guides/egress-credential-injection/): Put secrets into an actor's outbound HTTPS requests without the actor ever holding them. - [Observability](https://ate.dev/docs/guides/observability/): Logs, metrics, and traces for actors and the Agent Substrate components. - [SLOs and Alerting](https://ate.dev/docs/guides/slos-and-alerts/): Define SLIs, SLOs, and Prometheus alerting rules to monitor Agent Substrate in production. - [Rolling Upgrades](https://ate.dev/docs/guides/upgrade/): Runbook for a rolling upgrade of Agent Substrate. ## Reference - [API Guide](https://ate.dev/docs/reference/api-guide/): Define WorkerPools and ActorTemplates, the workload blueprints of Agent Substrate. - [Resource Model](https://ate.dev/docs/reference/resource-model/): The resources Agent Substrate exposes through its gRPC and Kubernetes APIs, and how they relate. - [kubectl-ate CLI Reference](https://ate.dev/docs/reference/kubectl-ate/): Manage atespaces, actor templates, actors, snapshots, egress policies, and logs with the kubectl-ate plugin. - [Glossary](https://ate.dev/docs/reference/glossary/): Definitions of core terms, resources, and components across Agent Substrate. - [Version Skew Policy](https://ate.dev/docs/reference/version-skew-policy/): Which component releases may run together, and the order to upgrade them in. ## Security - [Security Overview](https://ate.dev/docs/security/security/): The security scope, extensibility, and core principles of Agent Substrate. - [Threat Model](https://ate.dev/docs/security/threat-model/): Assets, trust boundaries, and threats considered for Agent Substrate. - [Extending Substrate](https://ate.dev/docs/security/extensibility/): Augment or replace the built-in ingress and egress gateways with custom policy enforcement points. ## Project - [Community](https://ate.dev/docs/project/community/): Connect with the Agent Substrate community on Slack, the mailing list, and weekly sync meetings. ## Optional - [Tutorials Overview](https://ate.dev/docs/tutorials/): Interactive step-by-step example workloads demonstrating stateful actors, sandboxes, request parking, egress, and multiplexing. - [GitHub Repository](https://github.com/agent-substrate/substrate): Source code, issue tracker, manifests, and release artifacts for Agent Substrate.