openEuler Agentic Infra OS: 20ms Sandboxes, 100k Scale — Which Agent Stack Layer Gets Absorbed?

Version Timeline and Release Cadence

openEuler originated from Huawei's EulerOS, open-sourced in September 2019 and donated to the OpenAtom Foundation in November 2021. The evolution relevant to AI agents has three steps:

2025: Super-Node OS. openEuler 24.03 LTS SP3 introduced cross-node resource coordination beyond single-machine management.

October 1, 2026: 26.09 Innovation Release. This is where the four core capabilities first appeared together. The release notes list: Agent-semantic KV Cache scheduling ( ram-a-kv), KV Cache aggregated transport ( MemFabric), multi-level cache ( LMCache-Ascend), programmable page cache ( ModelFS), sidecar observability ( AcTrail), non-invasive security governance ( AgentCensor), external memory with paging for context ( SCCS), and skill distribution ( SkillHub). The notes state openEuler completed its technical upgrade for Agentic AI, building a production-grade AI OS foundation.

November 13, 2026 (today): Positioning Upgrade + LTS Release. The Agentic Infra OS conference & openEuler Summit 2026 formally rebranded openEuler as an "OS for Agentic Infra" and released 24.03 LTS SP5 — an enhancement on the LTS track, separate from the 26.09 innovation line. Huawei's Peng Honghua stated continued contribution of core capabilities (fusion sandbox, KV Cache, memory system, Agent security governance) and tools like SkillHub.

Clarification: Media headlines about "openEuler officially releases OS for Agentic Infra" refer to the positioning upgrade and version release, not the first open-sourcing of four new components. To judge whether a component is brand-new today, refer to the 26.09 release notes and SP4 whitepaper.

Why Push Capabilities Down to the OS

OpenAtom OpenEuler Committee Chair Xiong Wei framed the shift: interaction mode moves from human-computer to multi-agent; workloads shift from short, deterministic requests to long, multi-step, uncertain executions. This creates three gaps traditional OSes weren't built for:

A single AI session may spawn dozens to hundreds of independent tasks , each needing its own sandbox.

Traditional container startup takes seconds to minutes; AI scenarios need sub-second startup and immediate teardown.

AI-generated code executed instantly lacks constraints — it could delete private data, steal credentials, corrupt local files, or access unauthorized networks.

OpenEuler Community Executive Director Liu Fei emphasized: startup speed, concurrency density, lifecycle control, security isolation, and environment customization cannot be easily patched at the application layer.

Performance Numbers — Read with Caveats

Official performance disclosures (StratoVirt + Conch runtime technical blogs and conference papers) report:

Sandbox startup latency as low as 20 ms .

Single-node density exceeds 2,000 sandboxes .

Large-scale concurrency test: 100,000 sandboxes launched in 10 seconds .

For comparison, the 24.03 LTS SP4 whitepaper (Firecracker microVM path) cites "sub-100ms cold start, hundreds of times faster than traditional VMs," scaling from a single sandbox to hundreds of concurrent instances per cluster, with Pause/Resume/Checkpoint/Fork and multi-hour sessions.

Two distinct paths, two test suites, two magnitudes — do not mix citations. One is the Firecracker-based LTS whitepaper figure; the other is StratoVirt/Conch self-reported peak values. "20 ms" is a minimum, not a typical value.

Four Capabilities Deconstructed: Kernel vs. Service

The official English technical paper explicitly splits architecture into Agent Kernel (system-level foundational capabilities) and Agent Service (reusable services: sandbox, memory, session management, Tool Gateway), adding "Rather than placing every capability inside the OS kernel." The more accurate description: the OS starts standardizing primitives that Agent frameworks previously built themselves.

KV Cache — Most Kernel-Like

The 26.09 trio divides labor clearly: ram-a-kv: Maps agent context to KV Cache chunks, predicts reuse, orchestrates prefetch/evict before next inference, uses global reference counting to protect cross-session shared chunks — targeting millisecond-level TTFT. MemFabric: Handles decode-phase intra-node DDR + HBM coordination , on-demand loading and aggregated transport, alleviating HBM shortage under high concurrency, improving BS and TPOT. LMCache-Ascend: Builds heterogeneous multi-level KV cache pool, enhances proprietary KVC pooling and PD transfer, provides storagebackend ecosystem interfaces compatible with mooncake, Yuanrong datasystem, etc. English paper also mentions global indexing, NUMA-aware placement, cross-node high-speed transport.

Your stack equivalents: vLLM's paged attention, LMCache/Mooncake prefix caching and PD separation — this layer is shifting from "framework-managed" to "OS-provided pooling and transport primitives."

Memory System — Not the Same as KV Cache, Often Confused

KV Cache reuses computed attention states (inference acceleration); memory solves cross-turn, cross-task, cross-session knowledge retention and retrieval. 26.09's SCCS uses compression replacement and on-demand fetch to give agent context an "external memory + paging mechanism," directly addressing long tasks where message history continuously consumes context window and raises token cost. English paper's Memory Agent line references OpenViking, oGMemory, openGauss for structured context management, hybrid vector+full-text retrieval, multi-agent knowledge sharing. Your stack equivalents: LangChain memory, mem0, custom vector stores.

Sandbox — From "Application Service" Compressed to "System Primitive"

Beyond startup/density numbers, SP4 whitepaper lists hardware-level isolation (each sandbox independent microVM, dedicated kernel), Jailer process, cgroups/namespaces isolation, network access control, CPU/memory/storage quotas, Dockerfile custom templates, full filesystem and process management, runtime package installation. Your stack equivalents: E2B, Daytona, custom gVisor or Firecracker wrappers.

Agent Security Governance — Explicitly a "Sidecar Service," Not Kernel Module

AcTrail

: Sidecar observability and governance service + plugin framework for agents. Non-invasive system-side observation + cross-layer behavior correlation unifies system behavior, model interactions, sensitive access handling into traceable agent semantic behavior trajectories. AgentCensor: Non-invasive security governance — no agent modification, no inference interference . Supports rapid policy config, dynamic update, hot reload, low overhead; provides session-level rich observability and layered observation. Community also describes CensorFS putting "isolation and reversibility of agent modifications into filesystem." Another technical material describes full chain: pre-execution prompt injection detection + hardware root-of-trust binding intent/behavior; mid-execution three-level dynamic sandbox (Conch/Session/Tool) real-time interception with 100% audit trail; post-execution lightweight file snapshot millisecond rollback.

Your stack equivalents: guardrails, audit logs, permission gateways, rollback mechanisms.

Terminology reminder: KV Cache transport, programmable page cache, sandbox isolation are system-level optimizations; AcTrail/AgentCensor are officially called "sidecar services and plugin framework." "Done at OS layer" means capability ownership, not runtime residency.

Numbers Require Context Tags

Every disclosed figure carries qualifiers: in targeted scenarios, According to openEuler's performance tests (vendor self-test), as low as (peak). None are third-party unified benchmarks; they cannot be subtracted from your own vLLM/llama.cpp runs.

A pre-brief number widely cited: in an ad business practice, optimizing DDR-to-accelerator data transfer and reducing cross-node communication cut KV Cache read/write latency by ~84% , boosting real-time bidding. Liu Fei presented this as a single business deployment case ; English paper's "TTFT down 30%–70%" is a different test, different metric (read/write latency vs. first-token wait) — cannot be added or cross-validated.

Ecosystem numbers also need tags: domestic openEuler OS cumulative installations expected to exceed 22 million (Xie Shaofeng, "expected"); Sullivan predicts 2026 China server OS new market share 61% ; community 2,200+ member organizations, 30,000+ contributors ; plan by year-end: 80% CVEs AI-assisted, 100% community service agents onboarded . Official homepage shows 30,052 contributors, 12,495 repos, 112 SIGs, 25 commercial OSVs.

Old cohort (2025 Super-Node OS phase): "2,100+ enterprises, 27k contributors, 16M installations, 57.3% 2025 new share." Today's cohort: "22M/61%/2,200+/30k+" — 61% is a prediction , not achieved share. Do not mix the two sets.

"Four Capabilities" vs. "Five Pillars" — Different Slices

Chinese conference press release lists four key capabilities : sandbox, KV Cache, memory system, Agent security governance. English technical paper lists five technical pillars : Sandbox, KV Cache, Memory Agent, Serverless Database (openGauss-based elastic, branchable data service — ms instance startup, second-level branch create/rollback), Open Heterogeneous Ecosystem (Kubernetes, openFuyao, vLLM, MindSpore, openGauss, covering x86/Arm/RISC-V/LoongArch and multi-vendor accelerators).

The difference is telling: Chinese slice isolates "security governance" as a capability; English slice elevates "data service & ecosystem" as pillars, with security scattered across sandbox isolation, sidecar observability, CensorFS reversible filesystem. Do not merge into "five things" or "four pillars," nor infer "two more components released today." They are two cuts of the same architecture.

Also: this stack targets servers, super-nodes, multi-vendor accelerators, industry compliance scenarios — not Mac/Apple Silicon local deployment . KV Cache pooling, PD separation, 10k+ sandbox concurrency simply don't exist on a single Mac with 24–512GB unified memory. If you follow local LLMs, today's news reads as "a layer of the inference stack is being standardized," not "my Mac can run a new model."

Actionable Mapping: Which Layer of Your Agent Stack to Offload

Inference Service Providers

Examine KV Cache layer first. LMCache-Ascend offers storagebackend ecosystem interfaces compatible with mooncake, Yuanrong datasystem — prefix caching and PD separation moving from framework-private to pluggable foundation. Validate on your own benchmarks first: 30%–70% TTFT drop is scenario-specific self-test; long-context, multi-tenant, cross-node topologies may yield completely different gains.

Agent Platform/Framework Builders

Focus on sandbox, memory, observability — three layers at risk of replacement. When OS delivers 20ms startup, Checkpoint/Fork, session-level trajectories, policy hot-reload, the marginal value of custom sandbox orchestration and audit layers declines. But "non-invasive" has a cost: sidecar observation lacks in-app semantics; business-level permission models, tool whitelists, human approvals must stay in application layer.

Compliance Deployments in Finance, Telco, State-Owned Enterprises

This is the most compelling track: non-invasive governance + full-chain audit trail + millisecond rollback + hardware-level isolation, with official claim of production deployment at top internet and finance customers. Start from 24.03 LTS SP5 delivery manifest vs. 26.09 component delta; don't demand innovation-release features in LTS production environments.

Understanding "How OS Changes in Agent Era"

Remember one sentence: Traditional OS manages resource lifecycles (process, memory, file, network); Agentic Infra OS manages task and context lifecycles — deployment, scheduling, isolation, context reuse, memory retrieval, tool invocation, observability, recovery. The first four are sinking; the latter four largely remain in application/framework layers.

Sources

openEuler 26.09 Innovation Release Notes (2026-10-01, official site)

openEuler 24.03 LTS SP4 Technical Whitepaper (Agent sandbox/kernel features)

openEuler Official Homepage (versions, real-time community data, community updates)

ITHome: openEuler Releases OS for Agentic Infra (11-13)

CNR: openEuler Releases OS for Agentic Infra (11-13)

CCIDNet: Conference Press Release (11-13)

ZhiDongXi / Tencent News: Pre-brief & -84% Case (11-10)

It's FOSS: Beyond AI Applications, How openEuler Is Rethinking the Agentic Infra OS (11-13, five pillars & self-test numbers)

Liu Fei Feixiangwang Interview: Agentic Infra Restructures OS Foundational Logic

Summary of caveats: ① Today's release is positioning upgrade + 24.03 LTS SP5; four components mostly from 10/1 26.09 innovation release and SP4 whitepaper. ② All performance numbers (20 ms, 2,000 sandboxes, 10s 100k, 1.5×–3×, 30%–70%, -84%) are vendor self-tests or single business cases, specific scenarios, non-third-party benchmarks — no cross-subtraction. ③ 22M installations is "expected to exceed," 61% is Sullivan prediction . ④ "Done at OS layer" = capability ownership, officially not all in kernel. ⑤ Article targets server/super-node/heterogeneous compute scenarios, unrelated to Mac local LLM deployment .