Confidential Computing, from host to workload
summary
A hands‑on walkthrough sets up a Fedora 38 VM on a 16‑core Linux 6.14 host with AMD SEV/SNP, checking BIOS Secure Nested Paging and libvirt/qemu compatibility, using kcli to create VMs, scvctl to export PDH/PEK and create a launch security session, and launching paused for pre-launch attestation. The lab shows memory encryption active but the demo fails until images and block I/O are encrypted because kernel I/O buffers clear the C‑bit — lesson: disk must be encrypted too; after fixing the disk and session the confidential VM boots as expected.
AI-written summary · about
chapters (10)
- 0:00Confidential computing intro
- 2:11Memory encryption in cloud
- 5:23Host setup for confidential
- 11:37Memory theft demo
- 16:14Fixing VM for confidential
- 20:24AMD SEV-SNP setup
- 25:20Launching confidential VM
- 30:00Demo failure and fix
- 33:16Tools for confidential clusters
- 38:10Cost of memory encryption
related talks
44mAdvancements in Confidential Computing
20mEncrypted Virtual Machine Images for Confidential Computing
17mLessons learned: scaling confidential clusters on OpenStack
13mVM Security with Confidential Computing
18mSecurely booting confidential VMs with encrypting disk
07mLightning Talk: Confidential VMs in Kubevirt: Securing VMs With Kube...
23mIntegrating Confidential Computing Into Cloud Infrastructure: Challenges and Opportunities
36mEverybody is talking about Confidential Computing - the minimum Devs should know