The safeguards map / 3.1 Execution sandboxes

Gramine

Confidential Computing Consortium (foundation). Other Linux Foundation, Gramine, a Confidential Computing Consortium project (an open community under the Linux Foundation), released. LGPL-3.0. Mapped; as of 20 Oct 2026.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

A library OS that runs unmodified applications inside Intel SGX enclaves, with a manifest file that sets the application's isolation policies.

Homepage / Repository

Where it sits

3.1 Execution sandboxes (primary): Runs unmodified applications inside Intel SGX enclaves and applies isolation policies that the owner sets in a manifest file.

Gramine runs unmodified applications inside Intel SGX.
captured 20 Oct 2026

Developers provide a manifest file to configure the application environment and isolation policies, Gramine automatically does the rest.
captured 20 Oct 2026

Facts

Concern: security
Names the law: no
Subject: software
Used by: those who run it
Runs: at runtime
Policy comes from: owner-entered settings
Can the agent bypass it: depends

Handoffs

None recorded. A mapped entry with no handoff is here for its foundation home.

Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.