CNCF Confidential Containers (CoCo) make it possible to run workloads on Trusted Execution Environments on CPUs and GPUs. Fortanix now offers support for this within its own Confidential AI. The data is only decrypted once both the hardware and the workload have been verified.
CoCo prevents the infrastructure administrator from accessing AI models, agents, and applications on Kubernetes. Since July, this CNCF project has been in the “incubating” phase, meaning it is under development within the coordinated open-source community.
The solution centers on protecting data at every stage of its lifecycle. Data at rest and in transit are familiar concepts and can be secured using established methods. However, CPU and GPU workloads typically lack this tooling. As a result, privileged administrators or cloud operators can access the data during this critical step.
Plugins for attestation and key release
CoCo runs Kubernetes pods in confidential VMs via Kata Containers. It therefore does not run directly on the shared host kernel. Fortanix has contributed open-source plugins that integrate CoCo with Fortanix Confidential Computing Manager (CCM) for attestation and Fortanix Data Security Manager (DSM) for key release. These plugins verify that each container is genuine, runs within a TEE, and complies with security policies. Only after these checks are the keys released and the data becomes readable. The CPU and GPU are verified together via what’s known as composite attestation. The keys remain in DSM, an HSM with FIPS 140-2 Level 3 certification.
“Attestation is a protocol. Trust is an operation,” summarizes Anuj Jaiswal, Chief Product Officer at Fortanix. Because attestation and key management are integrated into a single platform, he explains, teams do not need to build the trust layer themselves.
Also air-gapped
The solution is available as SaaS, but also supports on-premises or fully air-gapped environments. This allows companies to run models from cutting-edge AI labs alongside their sensitive data without exposing intellectual property to the LLM builder. Nvidia has already published a reference architecture for this use case using Kubernetes, Kata Containers, and CoCo.
Read also: F5 launches AI security platform and acquires SurePath AI