The safeguards map / 3.1 Execution sandboxes
Confidential Containers
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
Runs Kubernetes pods inside confidential virtual machines on trusted execution hardware, with owner-provisioned Rego policies at several layers.
Where it sits
3.1 Execution sandboxes (primary): Encapsulates pods in confidential virtual machines so sensitive workloads can run on untrusted hosts, and evaluates owner-provisioned Rego policies at several layers, including the key broker that releases secrets.
Confidential Containers encapsulates pods inside of confidential virtual machines
captured
With Confidential Containers, sensitive workloads can be run on untrusted hosts
captured
Confidential Containers uses three types of policies to secure workloads at different layers
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- owner-entered settings
- Can the agent bypass it
- depends
Handoffs
consumes Policy: Rego policies (OPA)
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.