How-to demos for OSS kagent + Agent Substrate (gVisor SandboxAgents).
The repo started as a stub README; each folder is a complete, human-reproducible
lab you can follow without inventing CRD fields or bumping pins.
Proven runtime on Sebastian's Viper lab (172.16.10.135):
| Piece | Pin |
|---|---|
| kagent OSS | 0.10.0-rc2 |
| Agent Substrate | 0.0.9 (not 0.0.12 — rc2 ActorTemplates need valueFrom + pauseImage) |
| Worker image | ghcr.io/kagent-dev/substrate/ateom-gvisor:v0.0.9 |
| WorkerPool | kagent-default |
| UI | NodePort 30500 |
Do not put AWS keys, GCP service-account JSON, ServiceNow passwords, FortiGate tokens, F5 passwords, Arista eAPI passwords, or other secret values in this git repo.
| Demo | Start here | What you get |
|---|---|---|
| aws-sandbox-agent/ | README.md | Isolated gVisor SandboxAgent (not a plain Agent Deployment) for AWS budget and capacity in us-east-2. FastMCP on :8084/mcp, Vault/ESO keys, snapshots on rustfs today (gs://ate-snapshots/kagent/aws-budget). Screenshots + architecture on the README; how-to in JOURNEY.md. |
| service-now-sandbox-agent/ | README.md | Isolated gVisor SandboxAgent (not a plain Agent Deployment) for ServiceNow IT tickets on a personal developer instance (host name only: https://dev203166.service-now.com). FastMCP on :8084/mcp, Vault/ESO keys (secret/platform/servicenow), snapshots on rustfs today (gs://ate-snapshots/kagent/servicenow). Architecture on the README; how-to in JOURNEY.md; live Viper record in REPORT.md. |
| fortigate-sandbox-agent/ | README.md | Isolated gVisor SandboxAgent (not a plain Agent Deployment) for the home FortiGate 80F (fw-maniak-hq, 172.16.10.1). FastMCP on :8084/mcp, Vault/ESO token (secret/platform/fortigate), snapshots on rustfs today (gs://ate-snapshots/kagent/fortigate). GitOps in k8s-viper. Screenshots + architecture on the README; live Viper record in REPORT.md. |
| gcp-sandbox-agent/ | README.md | Isolated gVisor SandboxAgent (not a plain Agent Deployment) for GCP budget and capacity in us-east1 (org maniak.io). FastMCP on :8084/mcp, Vault/ESO keys (secret/platform/gcp-budget), snapshots on rustfs today (gs://ate-snapshots/kagent/gcp-budget). Architecture on the README; how-to in JOURNEY.md. |
| f5-bigip-sandbox-agent/ | README.md | Isolated gVisor SandboxAgent (not a plain Agent Deployment) for the lab F5 BIG-IP (https://172.16.10.10). FastMCP on :8084/mcp, Vault/ESO keys (secret/platform/f5-bigip), snapshots on rustfs today (gs://ate-snapshots/kagent/f5-bigip). GitOps in k8s-viper. Screenshots + architecture on the README; live Viper record in REPORT.md. |
| arista-ceos-sandbox-agent/ | README.md | 3-node Arista cEOS Containerlab fabric (spine1 / leaf1 / leaf2, eBGP underlay) live on Viper (172.16.10.135, 2026-08-17 evening ET). Local image ceos:4.33.9M from official cEOS64-lab-4.33.9M.tar.xz (docker import only — no Hub pull). containerlab 0.78.2; BGP Established. kagent SandboxAgent/arista-ceos is Ready. Live CLI + kagent shots on the README; inspect/BGP in REPORT.md. |
- Open the demo folder README (screenshots + architecture — what it is, what “done” looks like).
- Walk that demo’s
JOURNEY.mdin order — every UI click and CLI command, with why. - Keep
docs/cli-runbook.mdopen if you only want copy-paste commands. - Never commit secret values. Manifests carry Vault paths and key names only.