Issues

• make gVisor write resolv.conf into the rootfs like micro-VM

  area/gvisorarea/node
  agent-substrate/substrate#2763 · Filter by author BenTheElder opened on Oct 16, 2026

• Move atelet's GKE ComputeClass toleration into the GKE install overlay

  agent-substrate/substrate#2760 · Filter by author roycaihw opened on Oct 16, 2026

• [Bug]: atunnel egress holds ~157 KB of buffers per idle connection

  area/networkarea/nodekind/bug
  agent-substrate/substrate#2759 · Filter by author chuangw6 opened on Oct 16, 2026

• Add kubectl ate update actor

  area/clikind/feature
  agent-substrate/substrate#2758 · Filter by author juli4n opened on Oct 16, 2026

• UpdateActor: allow a repoint to change image-volume references, since the resume under a replaced template already boots the guest fresh

  area/apiarea/api-machinerykind/feature
  agent-substrate/substrate#2754 · Filter by author AlexBulankou opened on Oct 16, 2026

• Define how higher order systems will consume Substrate API protos

  area/apikind/design
  Feature

  agent-substrate/substrate#2753 · Filter by author juli4n opened on Oct 16, 2026
  1

• FULL snapshot drops Unix-socket inodes from the rootfs upper while the listening process survives the restore

  area/microVMarea/storagekind/bug
  agent-substrate/substrate#2751 · Filter by author AlexBulankou opened on Oct 16, 2026
  1

• Worker seccomp: replace Unconfined with a Substrate-owned profile

  area/nodearea/securitykind/feature
  agent-substrate/substrate#2749 · Filter by author tjorourke opened on Oct 16, 2026

• atelet: detach must delete the actor's sandbox-assets hard links so the asset cache can evict them

  area/nodearea/storagekind/bug
  agent-substrate/substrate#2742 · Filter by author zoez7 opened on Oct 16, 2026

• Async suspend (pause) should not detach the actor's volumes

  area/api-machineryarea/storagekind/bug
  Task

  agent-substrate/substrate#2734 · Filter by author zoez7 opened on Oct 16, 2026
  

• Publish pullable images and a pre-built install for each release

  area/dev-infrakind/feature
  agent-substrate/substrate#2730 · Filter by author whysosuresh opened on Oct 15, 2026
  2

• Support principals that contain commas in comma-separated settings

  area/securitykind/feature
  agent-substrate/substrate#2729 · Filter by author SHRUTI6991 opened on Oct 15, 2026
  1

• objectstore-plugin: mint the source credential itself so downscoped tokens are never short

  area/identityarea/storagekind/feature
  agent-substrate/substrate#2722 · Filter by author ILLUM1N0X opened on Oct 15, 2026

• benchmarking: egress-tunnels, measuring how many tunnels the egress gateway carries and what each costs

  area/benchmarkingarea/networkkind/feature
  agent-substrate/substrate#2715 · Filter by author ygao-g opened on Oct 15, 2026
  

• [Bug]: atenet-router: CONNECT tunnels to different ports of one actor can reach another tunnel's port (connect.authority filter state is not pool-hashable)

  area/networkarea/securitykind/bug
  agent-substrate/substrate#2705 · Filter by author feifeigood opened on Oct 15, 2026

• filecache: TestGetFileToPublishedCopyIsWriteProtected fails when tests run as root

  area/storagearea/testskind/bug
  agent-substrate/substrate#2704 · Filter by author cloudonly opened on Oct 15, 2026
  1

• atelet: drop the legacy bare-binary runsc asset and rework the tests that rely on it

  area/gvisorarea/nodekind/cleanup
  agent-substrate/substrate#2697 · Filter by author dberkov opened on Oct 15, 2026

• worker IPs and epoch go stale when the worker pod sandbox is recreated

  area/apiarea/nodekind/bug
  agent-substrate/substrate#2692 · Filter by author BenTheElder opened on Oct 14, 2026 · M3
  7

• [Bug]: Cluster Autoscaler can't add nodes for micro-VM workers that request ate.dev/kvm

  area/microVMarea/nodearea/schedulingkind/bug
  agent-substrate/substrate#2691 · Filter by author roycaihw opened on Oct 14, 2026
  3

• ate-setup: support an operator-provided additional CA bundle

  area/dev-infraarea/securitykind/feature
  agent-substrate/substrate#2684 · Filter by author skamboj opened on Oct 14, 2026

• atelet: serve sandbox assets from the node-local file cache, keyed by sandbox runtime hash

  area/nodearea/storagekind/feature
  agent-substrate/substrate#2675 · Filter by author dberkov opened on Oct 14, 2026 · M3

• [Bug]: atelet credential-provider configuration is hard-coded to GKE host paths

  area/dev-infraarea/nodekind/bug
  agent-substrate/substrate#2669 · Filter by author skamboj opened on Oct 14, 2026

• DNS egress policy: handling aliases

  area/networkkind/feature
  agent-substrate/substrate#2663 · Filter by author bowei opened on Oct 14, 2026
  1

  

• objectstorage: make storage error descriptions extensible per backend

  area/storagekind/design
  agent-substrate/substrate#2661 · Filter by author annapendleton opened on Oct 14, 2026

• Cleanup the boolean flag experimental-enable-authz once authz is stable and tested.

  area/api-machineryarea/securitykind/cleanup
  agent-substrate/substrate#2659 · Filter by author SHRUTI6991 opened on Oct 14, 2026