Confidential Containers – Sensitive Data and Privacy in Cloud Native Environments
summary
Confidential computing protects data in use by combining hardware roots of trust (TPM), CPU TEEs (AMD SEV, Intel TDX) and remote attestation using measured boot PCRs (Ubuntu disk-unlock example). The CNCF Confidential Containers project aims to make this available to container stacks by adding a runtimeClass annotation that triggers attestation and secure key release into managed Kubernetes. Practical gaps remain: host-injected resources, exec/runtime APIs and dynamic pod specs require policy work; demo of key-release fails on the presenter’s laptop.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:12Why confidential containers matter
- 3:23Data in use and trust boundaries
- 8:03Cloud native integration rationale
- 9:49Key concepts: trust integrity attestation
- 12:37Root of trust explained
- 16:09Remote attestation flow
- 20:52Confidential Computing technologies
- 22:59Confidential containers overview
- 25:05Kubernetes pod isolation challenges
- 27:42Takeaways and project potential
- 28:52Q&A session
related talks
29mConfidential Containers: The Next Era of Cloud Data Security
38mConfidential Containers Explained
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
50mConfidential Containers: Why, How, and Where Are We?
27mTrust No One: Bringing Confidential Computing to Containers- 50mConfidential Containers: Why, How, and Where Are We?
11mLightning Talk: Computing Confidentially in the Clouds