Adding Arm RME/CCA Support in Confidential Containers
summary
Efforts add Arm CCA support into Confidential Containers by delivering a Rust s-token crate (v0.1) that decodes and verifies CCA evidence locally, wiring CoCo’s attestation-service to remote verification via Veraison integration, and extending Kata to launch Realm VMs on a cumu backend with EDk2 guest firmware (Linux 6.x). Demos run on pure software emulation so performance and hardware validation remain pending, patches are upstreaming, and plans include TD shim and CI for end‑to‑end tests.
AI-written summary · about
chapters (12)
- 0:00Arm CCA and Confidential Containers
- 1:50Arm CCA hardware and software
- 5:23Confidential Containers with CCA
- 9:16CCA support status
- 13:26Kata Containers for CCA realms
- 17:27Remote attestation with CCA token
- 23:21Verra service and attestation
- 28:25Live demo: CCA realm launch
- 32:50Q&A on open source contributions
- 37:25Performance and runtime integrity
- 41:06TCB components and trust
- 46:20Closing discussion
related talks
32mWhen Confidential Containers Meet Arm CCA
19mIntroduction of CCA on Arm
38mUnveiling Arm Confidential Computing Architecture Software Stack
34mCoCo-as: First Confidential Computing Attestation Solution of CNCF
19mA Verification Methodology for the Arm® Confidential Computing Architecture: Fr...
50mConfidential Containers: Why, How, and Where Are We?- 50mConfidential Containers: Why, How, and Where Are We?
39mFormal specification of attestation mechanisms in Confidential Computing