Implement Kubernetes Pod-Level Remote Attestation for Confidential Workloads on dstack

• URL: http://arxiv.org/abs/2606.03323v2
• Date: Wed, 03 Jun 2026 03:01:48 GMT
• Title: Implement Kubernetes Pod-Level Remote Attestation for Confidential Workloads on dstack
• Abstract summary: Confidential Containers (CoCo) enforce a strict "one Pod per VM" model that attests only the Guest OS stack, leaving container-level identity unverified and incurring prohibitive per-VM resource overhead.<n>We present dstack-capsule, a platform that enables Pod-level remote attestation on Intel TDX by allowing multiple Pods to share a single Confidential VM while each retains independent, hardware-backed proof of identity.<n>We evaluate the security properties, correctness, and performance characteristics of dstack-capsule, demonstrating that it achieves Pod-granularity verification without the resource overhead of per-VM isolation.
• Score: 9.739289919919694
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The rise of LLM-as-a-Service and other confidential cloud workloads demands cryptographic proof that user data is processed in a trusted, untampered environment. Existing solutions, notably Confidential Containers (CoCo), enforce a strict "one Pod per VM" model that attests only the Guest OS stack, leaving container-level identity unverified and incurring prohibitive per-VM resource overhead. We present dstack-capsule, a Kubernetes platform that enables Pod-level remote attestation on Intel TDX by allowing multiple Pods to share a single Confidential VM while each retains independent, hardware-backed proof of identity. Our key insight is a two-layer attestation architecture: static platform measurements are frozen in RTMR[3] via an irreversible privilege fuse, while dynamic Pod identities (pod_uid, pod_spec_hash, workload_id) are embedded in the TDX Quote's report_data field and signed by hardware on every request. dstack-capsule introduces (1) a Pod-level attestation protocol binding Pod spec digests to hardware-signed Quotes; (2) a privilege fuse mechanism that atomically transitions a node from setup mode to secure mode; (3) a multi-layer sandbox spanning storage, runtime, admission, API, and network isolation layers; and (4) a complete open-source implementation based on Kubernetes 1.32, Intel TDX, and Sysbox. We evaluate the security properties, attestation correctness, and performance characteristics of dstack-capsule, demonstrating that it achieves Pod-granularity verification without the resource overhead of per-VM isolation.

Related papers

• NACRE: Rethinking Confidential Containers through Native Architectural Support [10.992896257876362]
  Linux containers achieve high density and fast lifecycle operations by sharing the host kernel.<n>This paper presents NACRE, a hardware-software co-design for native confidential containers.
  arXiv  Detail & Related papers  (2026-09-03T13:42:11Z)
• Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture [0.0]
  Hardware-confined keys are accessible through a vendor-neutral PKCS interface.<n> Hardware confinement is the primary contribution.<n>We evaluate against 12 injection scenarios derived from AgentDojo's ImportantAttack template.
  arXiv  Detail & Related papers  (2026-08-06T15:04:26Z)
• PRISM: : Planning and Reasoning with Intent in Simulated Embodied Environments [59.07829883257003]
  Built on five multi-room apartments, PRISM structures 300 human-verified tasks into three capability tiers.<n>PRISM exposes an agent-agnostic executable action API that allows arbitrary agents to be evaluated end-to-end.
  arXiv  Detail & Related papers  (2026-05-12T04:59:47Z)
• ElephantBroker: A Knowledge-Grounded Cognitive Runtime for Trustworthy AI Agents [45.88028371034407]
  ElephantBroker is an open source cognitive runtime that unifies a Neo4j knowledge graph with a Qdrant vector store.<n>The system implements a complete cognitive loop (store, retrieve, score, compose, protect, learn) comprising a hybrid five source retrieval pipeline.
  arXiv  Detail & Related papers  (2026-03-26T07:03:12Z)
• n-VM: A Multi-VM Layer-1 Architecture with Shared Identity and Token State [1.7429038786735553]
  We present n-VM, a Layer-1 architecture that hosts n heterogeneous virtual machines as co-equal execution environments over shared consensus and shared state.<n>The design combines three components: a dispatcher that routes transactions by opcode prefix, a unified identity layer in which one 32-byte commitment anchors VM-specifific addresses, and a unified token ledger that exposes VM-native interfaces such as ERC-20 and SPL over a common balance store.
  arXiv  Detail & Related papers  (2026-03-24T19:19:25Z)
• SecCodeBench-V2 Technical Report [43.10947096543533]
  We introduce SecCodeBench-V2, a benchmark for evaluating Large Language Model (LLM) copilots' capabilities of generating secure code.<n>SecCodeBench-V2 comprises 98 generation and fix scenarios derived from Alibaba Group's industrial productions.<n>For each scenario, SecCodeBench-V2 provides executable proof-of-concept (PoC) test cases for both functional validation and security verification.
  arXiv  Detail & Related papers  (2026-02-17T10:47:06Z)
• LocalV: Exploiting Information Locality for IP-level Verilog Generation [45.78831906080782]
  The generation of Register-Transfer Level (RTL) code is a crucial yet labor-intensive step in digital hardware design.<n>Existing approaches-including fine-tuned domain-specific models and advanced agent-based systems-struggle to scale to industrial IP-level design tasks.<n>We propose LocalV, a multi-agent framework that leverages information locality in modular hardware design.
  arXiv  Detail & Related papers  (2026-01-31T13:01:16Z)
• pokiSEC: A Multi-Architecture, Containerized Ephemeral Malware Detonation Sandbox [41.99844472131922]
  pokiSEC is a lightweight, ephemeral malware detonation sandbox inside a Docker container.<n> pokiSEC integrates QEMU with hardware acceleration (KVM when available) and exposes a browser-based workflow.<n>We validate pokiSEC on Apple Silicon and Ubuntu (AMD64)
  arXiv  Detail & Related papers  (2025-12-24T00:38:40Z)
• Proof of Cloud: Data Center Execution Assurance for Confidential VMs [3.3382699707745522]
  Data Center Execution Assurance (DCEA) is a design generating "Proofs of Cloud"<n>DCEA binds a CVM to its underlying platform using vTPM-anchored measurements, ensuring CVM launch evidence and TPM quotes refer to the same physical chassis.<n>Our approach applies to CVMs accessing vTPMs and running on top of software stacks fully controlled by the cloud provider.
  arXiv  Detail & Related papers  (2025-10-14T13:01:48Z)
• Threat Modeling for Enhancing Security of IoT Audio Classification Devices under a Secure Protocols Framework [0.22369578015657954]
  We present a security protocol that treats the edge device, cellular network and cloud as three separate trust domains.<n>A STRIDE-driven threat model and attack-tree analysis guide the design.<n>Data in transit is protected by TLS 1.3 and hybridised with Kyber and Dilithium to provide post-quantum resilience.
  arXiv  Detail & Related papers  (2025-09-18T06:25:50Z)
• Rethinking the confidential cloud through a unified low-level abstraction for composable isolation [1.1595071545168434]
  We introduce a unified isolation model that delegates enforceable, composable, and attestable isolation to a single trusted security monitor: Tyche.<n>Tyche provides an API for partitioning, sharing, attesting, and reclaiming resources through its core abstraction, trust domains (TDs)<n>We provide an SDK to run and compose unmodified workloads as sandboxes, enclaves, and CVMs with minimal overhead compared to native Linux execution.
  arXiv  Detail & Related papers  (2025-07-16T16:08:24Z)
• Not All Prompts Are Made Equal: Prompt-based Pruning of Text-to-Image Diffusion Models [59.16287352266203]
  We introduce Adaptive Prompt-Tailored Pruning (APTP), a novel prompt-based pruning method for text-to-image (T2I) models.<n>APTP learns to determine the required capacity for an input text prompt and routes it to an architecture code, given a total desired compute budget for prompts.<n>APTP outperforms the single-model pruning baselines in terms of FID, CLIP, and CMMD scores.
  arXiv  Detail & Related papers  (2024-06-17T19:22:04Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.