Hands-on Workshop: Confidential Containers: Bringing Confid...
summary
Confidential Containers is a CNCF Sandbox project (accepted early 2022) that ships a runtime operator (first release end of September) which installs Kata-based VM enclaves and a process-mode using Occlum/Gramine; demos use scopio/oci-crypt to make encrypted container images, a sample key provider plus an attestation agent for key unwrap, and a containerd image transfer offload so images are pulled inside the guest and never land decrypted on the host. RuntimeClasses like Kata VM-based enclaves and Enclave CC process-based SGX switch modes; demos mostly work but some live-cluster steps fail intermittently.
AI-written summary · about
chapters (10)
- 0:00Workshop introduction
- 1:03What is confidential computing
- 7:03Isolation technologies compared
- 16:05Encrypted container images demo
- 31:30Confidential containers challenges
- 41:52Enclave CC process isolation
- 51:00VM-based containers demo
- 1:00:18Process-based containers demo
- 1:04:18Future of confidential containers
- 1:07:27Getting involved with project
related talks
38mConfidential Containers Explained
19mSandbox to confidential containers: A brief on the evolution of container isolation
50mConfidential Containers: Why, How, and Where Are We?
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing- 50mConfidential Containers: Why, How, and Where Are We?
05mRoad From Kata Containers To Confidential Containers + GPUs: From First Commit To CNC...
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes