Inclavare Containers: Confidential Computing for Cloud-Native Workloads
Shriira Press
Running unmodified containers inside hardware enclaves so that even the cloud you rent cannot read your secrets.
Welcome to Inclavare Containers: Confidential Computing for Cloud-Native Workloads.
Inclavare Containers is a CNCF sandbox project that brings hardware-based confidential computing to ordinary containers. It tackles a problem that has quietly shadowed cloud adoption for years: when you run a workload on someone else's machine, the people who run that machine — and the privileged software they control — can in principle read your code and your data. Inclavare answers this by running containers inside hardware enclaves, isolated regions of memory that even a compromised operating system or hypervisor cannot peer into. This book begins with the trust problem and the idea of a trusted execution environment, then explains the enclave model and Intel SGX that make it real. From there it walks through the project's own pieces: the rune OCI runtime that spawns enclaves, the Enclave Runtime PAL API and library operating systems like Occlum that run your application inside them, the shim-rune shim that wires everything into containerd and Kubernetes, and the attestation machinery — Rats-TLS, inclavared, and the Shelter verifier — that lets a remote party prove an enclave is genuine before trusting it with secrets. A closing chapter covers deployment, best practices, and where Inclavare sits among newer confidential-container efforts.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press