One Size Fits None: Lightweight Workload-Specialized Confidential Containers
Talkat KubeCon + CloudNativeCon + OpenInfra Summit + PyTorch Conference China 2026 · 2026-09-07..09-09·
summary
Benchmarks show Confidential Containers (CoCo) spends about 7 seconds startup and incurs roughly ~250 MB overhead per Pod VM because early Linux boot and guest-side services dominate latency and memory; image ingest in-guest adds extra cost. The proposal replaces QEMU+full Linux with lightweight VMMs (Firecracker/Dragonball), TD shim, reduced guest kernels or unikernels and host-side integrity (eStargz+dm‑verity / compositing options), and demonstrates prototype unikernel runs near 500 ms start with a 50 MB memory footprint, noting community support and attestation gaps.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:53Intel Trust Domain Extensions
- 5:19Confidential containers design
- 8:12Limitations of confidential containers
- 11:06Memory and latency overhead
- 14:20Lightweight confidential containers
- 17:26Reducing guest kernel overhead
- 21:43Unikernel support
- 23:52Reusing environments with snapshots
- 25:00Summary and Q&A
related talks
11mLightning Talk: Unikernels Vs Containers Vs VMs
50mConfidential Containers: Why, How, and Where Are We?- 50mConfidential Containers: Why, How, and Where Are We?
27mVMs in a container-centric world
17mServerless Functions Made Confidential and Efficient with Split Containers
27mTrust No One: Bringing Confidential Computing to Containers
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
34mTailor-Made Security: Building a Kubernetes Specific Hypervisor