The safeguards map / 3.1 Execution sandboxes

Occlum

Confidential Computing Consortium (foundation). Other Linux Foundation, Occlum, a Confidential Computing Consortium project (an open community under the Linux Foundation), released. BSD-3-Clause. Mapped; as of 21 Oct 2026.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

A library operating system for Intel SGX that runs unmodified applications inside enclaves, with an optional memory-protection-keys feature for fault isolation.

Homepage / Repository

Where it sits

3.1 Execution sandboxes (primary): Runs legacy applications inside Intel SGX enclaves, which protects the confidentiality and integrity of the workload, with optional Protection Keys for Userspace fault isolation inside the library OS.

thus protecting the confidentiality and integrity of user workloads transparently
captured 21 Oct 2026

Occlum offers an optional [**PKU**](./docs/pku_manual.md) (Protection Keys
captured 21 Oct 2026

Facts

Concern: security
Names the law: no
Subject: software
Used by: those who run it
Runs: at runtime
Policy comes from: vendor defaults
Can the agent bypass it: depends

Handoffs

None recorded. A mapped entry with no handoff is here for its foundation home.

Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.