Technology · Ebook

Confidential Containers: Hardware-Backed Trust for Kubernetes

by Shriira Press

Confidential Containers (CoCo) is a CNCF sandbox project that brings confidential computing to Kubernetes, wrapping each pod in a hardware Trusted Execution Environment such as Intel TDX or AMD SEV-SNP. This book begins with the data-in-use problem and the TEEs that solve it, then builds the full CoCo stack: how Kata Containers runs a pod inside a VM, how the guest pulls and decrypts its own images, how remote attestation with the Trustee key broker proves a workload is genuine before any secret is released, and how peer pods bring it all to ordinary clouds. It covers the trust model, image signing and encryption, the operator and runtime classes, day-two operations, and where the project fits in the cloud-native ecosystem.

Contents

1. 1Preface
2. 2Chapter 1 — The Data-in-Use Problem
3. 3Chapter 2 — Trusted Execution Environments
4. 4Chapter 3 — The Pod-in-a-VM Model
5. 5Chapter 4 — Architecture and Trust Model
6. 6Chapter 5 — Remote Attestation with Trustee
7. 7Chapter 6 — Guest Components Inside the Enclave
8. 8Chapter 7 — Securing Container Images
9. 9Chapter 8 — Peer Pods and the Cloud API Adaptor
10. 10Chapter 9 — Deploying and Operating CoCo
11. 11Chapter 10 — Confidential Containers in Practice