Three Pillars of Confidential Computing

Confidential Computing in cloud-native environments is organized into three deployment tiers, each building on the previous one.

The three pillars:

1. Confidential Virtual Machine — run a VM inside a TEE (the foundation)

2. Confidential Container — run a Kubernetes Pod inside a CVM

3. Confidential Cluster — run Kubernetes nodes themselves inside CVMs

Pillar 1: Confidential Virtual Machine (CVM)¶

A Confidential Virtual Machine is a VM that runs inside a TEE. It is the foundational building block.

What it provides:

• VM memory is hardware-encrypted — the hypervisor cannot read it

• Measured boot proves what software started inside the VM

• Remote attestation allows external parties to verify the CVM’s state

• TCB is reduced — you no longer need to trust the hypervisor or host OS

Pillar 2: Confidential Container (Pod)¶

A Confidential Container runs a Kubernetes Pod inside a CVM (which itself runs inside a TEE).

Key properties:

• Each Pod gets its own CVM — strong isolation between Pods

• The Kubernetes control plane (kubelet, containerd/crio) is outside the TEE — it is untrusted

• Container images are downloaded inside the CVM, not on the worker node.

• Secrets are delivered via remote attestation, not via K8s Secrets in etcd

• Policy enforcement controls what the K8s control plane can instruct the CVM to do

Implementation: The CNCF Confidential Containers (CoCo) project is the primary open-source implementation.

Pillar 3: Confidential Cluster¶

A Confidential Cluster runs Kubernetes nodes themselves inside CVMs (which run inside TEEs).

Comparing the Pillars¶

Choosing the Right Pillar¶