Show HN: CLRK, an open-source agent runtime with gVisor and MitM guardrails (github.com)

CLRK, pronounced "clerk," is a newly announced open-source agent runtime designed for Kubernetes that utilizes gVisor sandboxes to run large language model (LLM) agents securely. It intercepts all outbound traffic, including calls to LLM APIs and tools, without altering the agent's code. This interception allows for enhanced observability, governance, and cost control, providing organizations with better visibility into agent operations that are typically opaque. Users can easily declare agents using a container image, a trigger, and an egress policy, enabling both serverless bursting and sustained operations across Kubernetes fleets. The significance of CLRK lies in its ability to solve common production challenges associated with running untrusted workloads. It ensures zero-trust access by injecting credentials via a middleman proxy only when needed, preventing potential compromises from exposing sensitive data. The platform facilitates extensive telemetry collection through Invocation records backed by ClickHouse, enhancing auditing and monitoring capabilities. Additionally, CLRK comes equipped with a control plane, worker management, and support for multiple agent types, making it a comprehensive solution that not only improves security and governance but also streamlines the deployment of various agent workloads across different environments.