The Five Big Problems with Confidential Containers
summary
Confidential containers are now a CNCF sandbox but face five concrete hurdles: attestation interoperability across Intel TDX/AMD SEV and RATS plus a KBS key broker flow that must prove secrets are necessary; download and cache pain because encrypted layers break dedupe so local caching (see nidus caching) must move to block-level using dm-crypt/nbd; runtime overhead is modest (most benchmarks within ~5%), but disk/network bloat and containerd PR rejected for guest-side pulls force API and Kubernetes credential redesigns, and logs/debugging become practically unusable.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:54What is Confidential Computing
- 4:24Confidential Containers overview
- 9:02attestation
- 13:15image download
- 15:27Access control
- 16:39Debugability
- 17:16Conclusion
- 18:22Questions
related talks
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
38mConfidential Containers Explained
27mTrust No One: Bringing Confidential Computing to Containers
50mConfidential Containers: Why, How, and Where Are We?
29mConfidential Containers: The Next Era of Cloud Data Security
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
19mSandbox to confidential containers: A brief on the evolution of container isolation- 50mConfidential Containers: Why, How, and Where Are We?