Running Kubernetes pods inside hardware-encrypted enclaves, so even the host and the cloud operator cannot see your data.

Welcome to Confidential Containers: Hardware-Backed Trust for Kubernetes.

Confidential Containers, known as CoCo, is a CNCF sandbox project that brings confidential computing to Kubernetes. For decades, encrypting data at rest and in transit was the best we could do, but data in use — sitting decrypted in memory while a program runs — was always exposed to whoever controlled the machine. Confidential computing closes that last gap with hardware Trusted Execution Environments such as Intel TDX and AMD SEV-SNP, and CoCo wraps each Kubernetes pod inside one of these encrypted enclaves. This book begins with the data-in-use problem and the hardware that solves it, then builds up the full CoCo stack: how Kata Containers runs a pod inside a virtual machine, how the guest pulls and decrypts its own images, how remote attestation with the Trustee key broker proves a workload is genuinely protected before any secret is released, and how the peer-pods model brings all of this to ordinary clusters and public clouds. Along the way we cover the trust model, image signing and encryption, the operator and runtime classes, day-two operations, and where the project fits in the wider cloud-native ecosystem. By the end you will understand not just what CoCo does, but why each piece exists and how they compose into a workload the cloud operator itself cannot read.

This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.

A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.

We hope it serves you well.

— Shriira Press

Contents

1. Chapter 1 — The Data-in-Use Problem
2. Chapter 2 — Trusted Execution Environments
3. Chapter 3 — The Pod-in-a-VM Model
4. Chapter 4 — Architecture and Trust Model
5. Chapter 5 — Remote Attestation with Trustee
6. Chapter 6 — Guest Components Inside the Enclave
7. Chapter 7 — Securing Container Images
8. Chapter 8 — Peer Pods and the Cloud API Adaptor
9. Chapter 9 — Deploying and Operating CoCo
10. Chapter 10 — Confidential Containers in Practice