Towards Enclave-as-a-Container with Inclavare containers and Occlum
summary
Inclavare Containers implements an OCI-compliant enclave runtime that wires a containerd shim to enclave runtimes, integrates with Kubernetes runtimeClass, and lands monthly releases (v0.1 initial, v0.5 adds key management and k8s orchestration, v1.0 plans VM-based TE support like TDX and cluster attestation). Occlum is a memory-safe enclave OS written in Rust that targets Intel SGX, provides libc-like services, encrypted host I/O and lightweight processes. Demo builds an Occlum-based Docker image running a Go web server inside SGX on port 8019 and returns 200, proving the enclave-as-container flow works end-to-end.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:27The Challenges of Containers Security
- 6:47Enclave based on SGX TEE
- 7:44TEE(trusted execution environment)
- 8:06Confidential Computing Use Cases
- 9:29Inclavare Containers Overview
- 10:45Architecture of Inclavare Containers
- 13:20Milestone of Inclavare Containers
- 15:34Occlum: A Multi-Process Enclave OS
- 16:46Major Features of Occlum
- 18:05Milestones of Occlum
related talks
01h 14mHands-on Workshop: Confidential Containers: Bringing Confid...
38mConfidential Containers Explained
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure
33mDon't Peek Into my Container!
05mSponsored Keynote: Bringing Confidential Computing to Kubernetes
29mConfidential Containers: The Next Era of Cloud Data Security
14mYour Containers Aren’t Alone: Demystifying Container Isolation
18mHeterogeneous Hardware-Accelerated OCI Containers & Secure OCI Containers