Trust No One: Secure Storage With Confidential Containers
Talkat KubeCon + CloudNativeCon Europe 2025 · on Wednesday, 2025-04-02· at 14:30· Level 0 | ICC Auditorium·
summary
Claim: confidential containers secure storage so cloud providers cannot read data by keeping keys and encryption inside a TEE-backed VM. Implementation uses CSI driver to provision a virtio-blk device, a confidential data hub inside the VM that uses dm-crypt/dm-integrity to expose a plain-text mapped device, and an attestation + key broker flow that verifies Rego policies via regor-rust. Demo mounts a 10 GB XFS volume (dev-mapper) with transparent encryption. Container creation adds seconds of overhead; IO cost is expected but not yet measured.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:27Confidential computing overview
- 6:23Kubernetes integration
- 8:52Ephemeral storage design
- 13:28Security policy and attestation
- 19:08Ephemeral storage demo
- 22:23Persistent storage challenges
- 27:02Summary and future
- 28:34Q&A
related talks
29mConfidential Containers: The Next Era of Cloud Data Security
27mTrust No One: Bringing Confidential Computing to Containers
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
38mConfidential Containers Explained
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!
50mConfidential Containers: Why, How, and Where Are We?
26mThe Five Big Problems with Confidential Containers
16mStorage subsystem for hardware TEE based confidential containers