Fortanix has integrated Confidential Containers into its Confidential AI platform, connecting Kubernetes workload attestation directly to conditional encryption-key release inside hardware-based trusted execution environments.
Confidential Containers, a project backed by the Cloud Native Computing Foundation, runs Kubernetes pods inside confidential virtual machines. Unlike standard containers that rely on the host operating system for isolation, these setups use hardware protections to encrypt memory and restrict runtime access. Fortanix connects these workloads to two primary services: Confidential Computing Manager for environmental verification, and Data Security Manager to release keys only after successful validation.
Hardware Verification Settings and Platform Deployment
Fortanix’s Confidential Computing Manager can attest processor and graphics processing unit environments together, depending on configuration choices. According to deployment guides for Intel Trust Domain Extensions, administrators can set GPU attestation to required or ignored. The required setting forces the manager to validate GPU evidence through NVIDIA’s attestation service, while the ignored setting checks only that evidence is present without evaluating the result. Release notes issued on September 17 added application registration for both Intel Trust Domain Extensions and AMD Secure Encrypted Virtualization-Secure Nested Paging.
Fortanix extends Confidential AI to Kubernetes workloads through Confidential Containers https://t.co/4EHH2HYC9h
Deployment requires prior configuration of host firmware and kernel settings, as the Fortanix Helm chart does not configure those layers automatically. Anuj Jaiswal, chief product officer at Fortanix, explained the platform integration in the company announcement. “With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves,” Jaiswal said.
Open Source Components and Alternative Solutions
Similar attestation and conditional secret delivery mechanisms already exist within open-source Trustee components. Trustee splits evidence appraisal from resource authorization, using an attestation service to compare platform claims against reference values before a Key Broker Service applies user-defined policies. Microsoft offers an alternative managed approach through Azure Secure Key Release, which integrates Key Vault Premium and Managed HSM with Azure Attestation to release exportable keys.
Despite these hardware and software safeguards, the trust model for Confidential Containers carries explicit limitations. Guest kernels and helper processes remain inside the trust boundary, requiring teams to trust those underlying components. Hardware measurements typically secure only the guest environment while container verification occurs separately. Enclave applications can still expose external interfaces, and the platform architecture excludes denial-of-service protection alongside hardware side channels.
Frequently Asked Questions
What services does Fortanix use to handle workload attestation and key release?
Fortanix connects workloads to Confidential Computing Manager to verify the environment and Data Security Manager to release encryption keys only to verified environments.
How does the Intel TDX deployment handle GPU attestation settings?
The Intel TDX deployment guide provides two options. The required setting validates GPU evidence through NVIDIA’s attestation service, whereas the ignored setting checks only for the presence of evidence and disregards its contents.
What specific hardware architectures were added in the September 17 release notes?
The release notes added application registration for AMD Secure Encrypted Virtualization-Secure Nested Paging and Intel Trust Domain Extensions.