Confidential Containers: Why, How, and Where Are We?
Talkat ContainerCon @ OSS EU 2023 · on Tuesday, 2023-09-19· at 11:25· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Confidential Containers (CoCo) is a CNCF project that lets existing containers run inside confidential VMs using Kata Containers and a cloud API adapter, releasing image decryption keys from a Key Broker Service after remote attestation. Deployments take a real-world hit—expect 30–45 second VM startup for cloud-spawned CVMs—and CPU vendors report around ~2% CPU overhead. Remaining engineering problems include secure image pulling from an untrusted host, secure scratch space, and reducing the trusted computing base.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:39Why confidential computing
- 10:06Core principles
- 15:17What are confidential containers
- 22:46Kata Containers for confidential pods
- 28:12Remote attestation
- 34:37Live demo: confidential deployment
- 39:15Challenges in confidential containers
- 42:54Q&A
related talks
50mConfidential Containers: Why, How, and Where Are We?
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
29mConfidential Containers: The Next Era of Cloud Data Security
38mConfidential Containers Explained
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...
32mWhen Confidential Containers Meet Arm CCA