Confidential Containers Explained
summary
Project is a CNCF sandbox that runs Kubernetes pods inside per-pod confidential VMs (Kata-like runtime) using TEEs such as AMD SEV, Intel TDX/SGX and IBM SE, with attestation, encrypted container images and a key brokering flow so hosts cannot read or tamper with memory or images. An operator deploys the runtime and enclave stack, a prototype secure storage and attestation protocol exist, and a first official release is planned in months — demos show the flow works end to end under attestation.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:50Project Definition
- 7:07Confidential Computing
- 11:51How Does It Protect Kubernetes
- 22:01Deploy Confidential Containers
- 23:31Why Do We Care
- 27:31What Next
- 28:21Questions
related talks
29mConfidential Containers: The Next Era of Cloud Data Security
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
50mConfidential Containers: Why, How, and Where Are We?
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
19mSandbox to confidential containers: A brief on the evolution of container isolation
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...
27mTrust No One: Bringing Confidential Computing to Containers
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing