蚂蚁 inclusionAI 开源 AKernel：面向 Agent 的数据中心级可编程基础设施

inclusionAI; AKernel

Repository navigation

Code; Issues1 (1); Pull requests10 (10); Actions; Security and quality; Insights

NotificationsYou must be signed in to change notification settings; Fork10 (10); Star41 (41)You must be signed in to star a repository

Programmable datacenter-scale infrastructure for Agents.

Repository files navigation

README; Apache-2.0 license

Overview

AKernel (Agent Kernel) is a distributed kernel that combines the performance of AFaaS with the architecture of openYuanrong, enabling true "datacenter use" — treating the entire datacenter as a programmable extension of your AI Agent.

Traditional infrastructure tools (IaC, Kubernetes-native platforms, multi-cloud Terraform, and vendor-specific CDKs) are designed for provisioning infrastructure, not operating it. They fall short for AI agents, RL training, and data pipelines that require runtime elasticity, dynamic workflows, and programmatic access to datacenter capabilities.

AKernel solves this with five key advantages:

Datacenter Use: Unified Programming Interface

A single Python SDK (akernel_sdk) to programmatically control compute, networking, and storage — no YAML, no manual orchestration. Multi-language support is planned.

One all-in-one image, multiple deployment targets — deploy in under 10 minutes:

Secure Isolation with Extreme Performance

40 ms cold start*: Fork-based launch with lazy loading for near-zero startup latency; Sandbox isolation: gVisor by default, with Kata Containers and Firecracker available on KVM-capable nodes; Same-node recovery: Checkpoint runsc and Firecracker workloads and reload the same logical sandbox

* Planned for an open-source release and not available in AKernel v0.1.0.

AI-Native Development and Operations

AI-contributed codebase: Significant portions of AKernel code are authored by AI, enabling rapid iteration; AI-driven operations: Cluster deployment, day-2 operations, and troubleshooting powered by AI agents; Agent-friendly: Built as infrastructure that AI agents can programmatically control and reason about

Full-Stack Observability

Built-in OpenTelemetry (OTEL) integration provides complete observability out of the box — not just resource management, but the full picture:

Metrics: Prometheus-based collection for compute, networking, and sandbox performance; Dashboards: Pre-configured Grafana dashboards for real-time cluster monitoring; Tracing & Logging: End-to-end request tracing and centralized log aggregation

Quick Start

Quick Navigation

💡 Examples - AKernel SDK examples and use cases; 🏗️ Architecture - System design and components; 🚀 Deployment - Installation and configuration guide

Run Locally from Source

On Linux with native AMD64/ARM64 Docker, or Apple Silicon Mac with OrbStack, run from the source checkout:

This builds and starts a runsc standalone instance. Use make standalone-status to inspect it and make standalone-stop after releasing its sandboxes. See the Standalone Guide for prerequisites, SDK setup, and optional runtimes.

Bootstrap a Cluster

AKernel provides guided Terraform deployment for Alibaba Cloud ACK and Huawei Cloud CCE. Clone the repository and prepare the cloud credentials before selecting one of the image options below.

The workflow requires Terraform, Docker, Helm, kubectl, Python 3, GNU Make, and cloud credentials with permission to create the required infrastructure. For Alibaba Cloud, export the credentials and region first:

Option 1: Use the Official Image

Use the public AKernel image from Docker Hub:

Option 2: Build from Source

Configure a registry that your cluster can access, then build and push the all-in-one image before deployment:

See the Deployment Guide for prerequisites, cloud-specific configuration, deployment verification, and cluster cleanup, and the Build Guide for development details.

Create a Sandbox

Install the Python SDK. The default installation includes the openyuanrong-sandbox backend:

The actor-based openyuanrong-sdk backend is deprecated and retained only for compatibility with existing applications. New applications should use the default openyuanrong-sandbox backend. When the actor extra is installed, both backend packages are present and openyuanrong-sandbox remains the automatic default. Set AKERNEL_BACKEND=openyuanrong-sdk before importing akernel_sdk to select the actor backend:

When openyuanrong-sdk is used from a YuanRong function, the SDK process inherits runtime paths configured by builder/scripts/entryfile.sh. That entrypoint exports PYTHONPATH and, in some runtime layouts, LD_LIBRARY_PATH; both variables are inherited by the application and its child processes. PYTHONPATH prepends the runtime site-packages directory and can change import resolution or shadow application dependencies. LD_LIBRARY_PATH prepends runtime library directories and can change native library resolution, causing ABI or version conflicts.

Configure the AKernel environment:

Use the SDK to create and interact with a sandbox:

Experimental gVisor sandboxes can request an exact NVIDIA GPU model:

GPU sandboxes require a compatible NVIDIA node and the gVisor runsc runtime. storage_mb is measured in MiB and is supported by runsc and Firecracker.

See the complete basic usage example, the sandbox runtime example, and the other SDK examples for more operations.

Sandbox runtimes: gVisor by default; Kata Containers and Firecracker on KVM-capable nodes; and an explicitly enabled native Linux runc backend; sandboxd: Sandbox lifecycle daemon with pluggable sandbox runtime integration; distill-fs: Rust-based FUSE filesystem for lazy rootfs access, chunk caching, and deduplication; packaged from a static GitHub Release with its version and checksum pinned in AKernel

Cluster-Wide Services

Distributed Scheduler: Workload-aware placement and scaling; API Gateway: Unified interface for all operations; Object Storage: Raw and Nydus rootfs images and read-only sandbox mounts; Cloud Provisioning: Terraform modules for Alibaba Cloud ACK and Huawei Cloud CCE

How It Works

Agent Submits Workload: Through unified API or SDK; Scheduler Places Sandbox: Selects a worker based on requested CPU, memory, storage, accelerator model, and available capacity; Sandbox Created: Prepares the rootfs and network and starts the selected sandbox runtime on the worker; Workload Executes: In secure, isolated sandboxes; Resources Recycled: Deletes the sandbox and returns its capacity to the cluster

Roadmap

Kata Containers runtime on KVM-capable nodes; Firecracker microVM runtime on KVM-capable nodes; Optional native Linux runc runtime; Stateful sandbox network ACLs for CIDRs, domains, protocols, and ports; Fork-based sandbox launch based on gVisor; Same-node checkpoint recovery for runsc and Firecracker; Support for GKE and AWS; Cgroup v2 node support

License

AKernel is licensed under the Apache License 2.0.

Programmable datacenter-scale infrastructure for Agents.