Confidential Container
Kata containers are also called secure containers. They run in lightweight VMs instead of the host kernel. In this way strong isolation is enabled to prevent security issues between different containers, similar to being on conventional VMs.
Based on Kata containers released in the Kata/Coco community, confidential containers in the TEE replace the lightweight VMs with virtCCA cVMs, further improving the security of Kata containers. In addition, confidential containers have security features such as remote attestation, image signature and encryption, and device passthrough to build full-link secure cloud capabilities.
Confidential containers are built based on the entire software stack that integrates Kubernetes, containerd, Kata, QEMU, and KVM. The management plane still uses Kubernetes and containerd, and confidential containers are used in a manner similar to common containers. Figure 1 shows the Kata confidential container deployment architecture.
