Blog
-
PQC Support in KBS Protocol
Wednesday, September 23, 2026 in Blog
IntroductionThose who are interested in Confidential Containers as a framework, already have a high bar for security. The delivery of resources from the trusted Trustee services into untrusted guest components requires resources to be secured in …
-
Deploy Trustee in Kubernetes
Wednesday, August 19, 2026 in Blog
IntroductionIn this blog, we’ll be going through the deployment of Trustee, the Key Broker Service that provides keys/secrets to clients that want to execute workloads confidentially. Trustee provides a built-in attestation service that complies to …
-
Encrypted Persistent Storage for Peer Pods with the CAA CSI Block Driver
Friday, August 14, 2026 in Blog
IntroductionWhen you use the Kata remote hypervisor (peer-pods) for confidential containers, you can run into problems if your workload relies on Kubernetes CSI storage for persistent data. Until v0.21.0 we had csi-wrapper. It sat in front of …
-
BYOM Provider: Bring Your Own CVMs to run Confidential Containers
Monday, May 25, 2026 in Blog
IntroductionThe BYOM (Bring Your Own Machine) provider is a unique Cloud API Adaptor (CAA) provider that enables you to use pre-created CVMs as peer pods. Unlike other CAA providers (AWS, Azure, GCP, etc.) that dynamically provision CVMs, BYOM …
-
Extending Trustee Key Broker Service with Remote Plugins
Tuesday, April 28, 2026 in Blog
Confidential Computing provides hardware-backed isolation and remote attestation, ensuring workloads execute inside trusted execution environments (TEEs) with verifiable integrity. Building on this, Confidential Containers extends these guarantees to …
-
Integrate Trustee with the External Secrets Operator
Tuesday, March 31, 2026 in Blog
IntroductionThe Trustee operator simplifies configuring secrets and serving them to confidential container pods that execute inside trusted execution environments (TEEs). You can set up the required secrets as Kubernetes Secret objects and make them …
-
How Switchboard Oracles Leverage Confidential Containers for Next-Generation Web3 Security
Tuesday, March 11, 2025 in Blog
The Web3 ecosystem depends on oracles to bridge on-chain smart contracts with off-chain data. However, this critical infrastructure has historically faced significant security challenges. Today, we’re excited to share how Switchboard has …
-
Confidential Containers(CoCo) and Supply-chain Levels for Software Artifacts (SLSA)
Monday, February 17, 2025 in Blog
A few of us in the CNCF Confidential Containers (CoCo) community met some time ago to discuss provenance management in the project. One of our focus items was to introduce support for generating SLSA provenance and SBOM for CoCo artifacts. We are …
-
Confidential Containers without confidential hardware
Tuesday, December 03, 2024 in Blog
Note This blog post was originally published here based on the very first versions of Confidential Containers (CoCo) which at that time was just a Proof-of-Concept (PoC) project. Since then the project evolved a lot: we managed to merge the work to …
-
Policing a Sandbox
Thursday, August 15, 2024 in Blog
In a previous article we discussed how we can establish confidence in the integrity of an OS image for a confidential Guest, that is supposed to host a collocated set (Pod) of confidential containers. The topic of this article will cover the …