Confidential Containers

Kata containers are also called secure containers. They run in lightweight VMs instead of the host kernel. In this way strong isolation is enabled to prevent security issues between different containers, similar to being on traditional VMs.

Based on Kata containers released in the Kata/Coco community, confidential containers in the TEE replace lightweight VMs with virtCCA cVMs, further improving the security of Kata containers. In addition, confidential containers have security features such as remote attestation, image signature and encryption, and device passthrough to build full-link secure cloud capabilities.

Confidential containers are built based on the entire software stack that integrates Kubernetes, containerd, Kata, QEMU, and KVM. The management plane still uses Kubernetes and containerd, and confidential containers are used in a manner similar to common containers.