Confidential Containers: Why, How, and Where Are We?
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 11:25· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
CNCF Confidential Containers (CoCo) aims to let unmodified container workloads run inside CPU-backed TEEs by wiring Kubernetes to confidential VMs using Kata Containers, a cloud API adapter, an attestation agent and a Key Broker Service that only releases decryption keys after remote attestation. Demo shows encrypted images decrypted in-VM after attestation, VM spawn times around 30–45s, and reported CPU overheads near 2% but nontrivial I/O and image-pull complexity. Remaining gaps: secure image pulling, de-privileging control plane, measured TCBs and observability.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:39Why confidential computing
- 10:06Core principles
- 15:17What are confidential containers
- 22:46Kata Containers for confidential pods
- 28:12Remote attestation
- 34:37Live demo: confidential deployment
- 39:15Challenges in confidential containers
- 42:54Q&A
related talks
50mConfidential Containers: Why, How, and Where Are We?
29mConfidential Containers: The Next Era of Cloud Data Security
38mConfidential Containers Explained
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
27mTrust No One: Bringing Confidential Computing to Containers
38mCloud native Confidential: Isolating Kubernetes Pods with Confidential Computing
49mCloud Native Confidential: Isolating Kubernetes Pods with Confidential Computing
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...