EBCC: Enclave-Backed Confidential Containers via OCI-Compatible Runtime Integration

• URL: http://arxiv.org/abs/2605.13676v1
• Date: Wed, 13 May 2026 15:35:12 GMT
• Title: EBCC: Enclave-Backed Confidential Containers via OCI-Compatible Runtime Integration
• Abstract summary: EBCC (Enclave-Backed Confidential Containers) is an OCI-compatible runtime architecture for managing composite confidential-computing workloads.<n>It treats the REE-side anchor and TEE-side confidential stages as a single containerized confidential-computing composite.<n>It also maintains persistent per-instance state and per-stage artifacts for request handling, response generation, logging, and evidence binding.
• Score: 28.95046818628377
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Container runtimes provide a stable operational interface for deploying, monitoring, and controlling modern workloads, while trusted execution environments (TEEs) provide hardware-enforced isolation for sensitive computation. Existing confidential-container systems often rely on VM-backed deployment stacks or TEE-specific execution substrates, which can separate confidential execution from the conventional OCI runtime lifecycle. This paper presents EBCC (Enclave-Backed Confidential Containers), an OCI-compatible runtime architecture for managing composite confidential-computing workloads. EBCC treats the REE-side anchor and TEE-side confidential stages as a single containerized confidential-computing composite, preserves standard OCI lifecycle operations, and keeps TEE-specific execution behind a backend adapter. It also maintains persistent per-instance state and per-stage artifacts for request handling, response generation, logging, and evidence binding. We implement EBCC on a Keystone backend and evaluate its correctness, performance, footprint, and concurrent execution behavior. The results show that EBCC introduces additional latency over native Keystone execution, mainly due to lifecycle mediation, request validation, EID allocation, backend dispatch, and artifact persistence, while keeping the added footprint concentrated on host-side management state. Cross-TEE case studies on SGX, TDX, and OP-TEE show that the same lifecycle and stage abstraction can be mapped to enclave-style, VM-style, and embedded-style TEEs. These results indicate that EBCC can make TEE-backed execution manageable through an OCI-style lifecycle without materially enlarging the protected-side TCB.

Related papers

• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Learning New Tasks via Reusable Skills: Skill-Compositional Experts for Embodied Continual Learning [60.37693496953694]
  Embodied Continual Learning (ECL) aims to enable robots to continually acquire new manipulation tasks.<n>ECL suffers from more severe catastrophic forgetting.<n>Key challenge in ECL lies in structured skill reuse across continually evolving tasks.
  arXiv  Detail & Related papers  (2026-06-14T09:02:49Z)
• Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation [29.46902986541309]
  Self-hosted computer-use agents (SHCUAs) combine natural-language interaction with direct access to host-side resources.<n>We present an operation-centric model for risk-based confinement of SHCUA operations.
  arXiv  Detail & Related papers  (2026-05-07T15:08:40Z)
• AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents [16.761926457126428]
  This paper presents AgentWard, a lifecycle-oriented, defense-in-depth architecture that systematically organizes protection across five stages.<n>AgentWard integrates stage-specific, heterogeneous controls with cross-layer coordination, enabling threats to be intercepted along their propagation paths while safeguarding critical assets.
  arXiv  Detail & Related papers  (2026-04-27T16:22:27Z)
• Benchmarks for Trajectory Safety Evaluation and Diagnosis in OpenClaw and Codex: ATBench-Claw and ATBench-CodeX [54.138213405601896]
  ATBench is a diverse and realistic agent trajectory benchmark for safety evaluation and diagnosis.<n>This report presents ATBench-Claw and ATBench-CodeX, two domain-customized extensions that carry ATBench into the OpenClaw and OpenAI Codex / Codex-runtime settings.
  arXiv  Detail & Related papers  (2026-04-16T10:45:13Z)
• HPCCFA: Leveraging Hardware Performance Counters for Control Flow Attestation [10.283785839400801]
  Trusted Execution Environments (TEEs) allow the secure execution of code on remote systems without the need to trust their operators.<n> static attestation does not cover runtime attacks, where an attacker exploits vulnerabilities in the software inside the TEE.<n>We present a method to extend TEEs with CFA and discuss how it can prevent exploitation in the event of detected control flow violations.
  arXiv  Detail & Related papers  (2026-03-31T13:51:30Z)
• PPTAM$η$: Energy Aware CI/CD Pipeline for Container Based Applications [47.84270304529455]
  PPTAM$$ is an automated pipeline that integrates power and energy measurement into GitLab CI for containerised API systems.<n>The pipeline makes energy visible to developers, supports version comparison for test engineers and enables trend analysis for researchers.
  arXiv  Detail & Related papers  (2026-02-12T15:38:35Z)
• SWE-World: Building Software Engineering Agents in Docker-Free Environments [91.17484806743641]
  SWE-World is a Docker-free framework that replaces physical execution environments with a learned surrogate for training and evaluating software engineering agents.<n>We show that SWE-World raises Qwen2.5-Coder-32B from 6.2% to 52.0% via Docker-free SFT, 55.0% with Docker-free RL, and 68.2% with further TTS.
  arXiv  Detail & Related papers  (2026-02-03T11:44:39Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments [25.443755388774832]
  We present Arca, a lightweight confidential container framework based on a TEE-in-Container architecture.<n>Arca isolates each workload in an independent, hardware-enforced trust domain.<n>We implement Arca on Intel SGX, Intel TDX, and AMD SEV.
  arXiv  Detail & Related papers  (2026-01-03T15:42:20Z)
• Provable Execution in Real-Time Embedded Systems [8.816934283264633]
  We develop Provable Execution Architecture for Real-Time Systems (PEARTS)<n>PEARTS is the first PoX system that can be directly deployed alongside a commodity embedded real-time operating system (FreeRTOS)
  arXiv  Detail & Related papers  (2025-05-20T02:31:13Z)
• RaceTEE: Enabling Interoperability of Confidential Smart Contracts [0.2864713389096699]
  RaceTEE is a novel framework that leverages offchain TEE-enabled nodes to efficiently execute confidential, long-lived smart contracts.<n>We implement a RaceTEE prototype using Intel SGX, integrate it with arbitrary smart contracts, and release it as open source.
  arXiv  Detail & Related papers  (2025-03-12T12:10:02Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.