Fortanix has added support for Confidential Containers to its Confidential AI platform, according to infoq.com. The integration links attestation of Kubernetes workloads to the release of encryption keys, so a workload that satisfies security policy can decrypt models and sensitive data inside hardware-backed trusted execution environments (TEEs). The company says the capability is available now.
Confidential Containers, known as CoCo, is a Cloud Native Computing Foundation project that runs Kubernetes pods inside confidential virtual machines backed by hardware TEEs. The announcement was reported by infoq.com on 31 October 2026.
Why it matters
Ordinary containers rely largely on the host operating system for isolation. Confidential VMs instead use hardware protections that encrypt memory and limit access to a workload while it runs, which extends protection to data in use rather than only data at rest or in transit. That can allow teams to run sensitive workloads on shared infrastructure.
The benefit depends on getting two things right: trusting the guest software and configuring attestation and key release correctly. Fortanix's contribution sits in that second area, connecting the verification step to the delivery of keys.
How the key release works
According to infoq.com, Fortanix's technical overview describes plugins that connect CoCo workloads to two services. The Confidential Computing Manager (CCM) verifies the environment, and the Data Security Manager (DSM) hands out keys only to environments that CCM has approved. Fortanix says CCM can attest the processor and graphics processing unit together, a check that depends on how it is configured.
Inside CoCo, image pulling and unpacking take place in the confidential guest. An Attestation Agent gathers hardware evidence, and a Confidential Data Hub retrieves secrets once verification succeeds. In the workflow Fortanix describes, keys remain in DSM when attestation fails, leaving the workload unable to decrypt protected models or data.
Anuj Jaiswal, Fortanix's chief product officer, said in the announcement that putting attestation and key management on one platform lets teams adopt standard CoCo without having to build the trust layer themselves, infoq.com reports. Fortanix says CCM and DSM run in a clustered setup with round-the-clock support, and can be delivered as a hosted service, on-premises or in an air-gapped environment.
Configuration choices and existing alternatives
Fortanix's deployment guide for Intel TDX sets out two GPU options. Under Required, CCM validates GPU evidence through NVIDIA's attestation service; under Ignored, it only confirms that evidence exists and sets the result aside. The guide also states that the Fortanix CoCo Helm chart does not handle host firmware or kernel settings, which teams must complete before installation.
Attestation paired with conditional secret delivery is not new to CoCo. Its open-source Trustee components already separate evidence appraisal from resource authorisation: an attestation service compares platform claims against reference values, and a Key Broker Service then applies a user-defined policy before releasing secrets from local storage, a plugin or an external key store. A passing attestation is not enough on its own — the policy must also permit the request. Trustee likewise accepts GPU evidence bound to the processor's attestation report.
Microsoft's Azure Secure Key Release provides a managed option through Key Vault Premium and Managed HSM, working with Azure Attestation. It releases exportable keys, not secrets or certificates, according to infoq.com.
Limits of the trust boundary
The guest kernel and helper processes inside a pod fall within the trust boundary, so teams have to trust them as well. CoCo's trust model explains that hardware measurements typically cover the guest environment, while container verification is a separate stage. It also cautions that an enclave application can still expose a risky external interface, and it does not cover denial-of-service protection or hardware side channels. Attestation alone does not show that an AI application handles data safely.
Fortanix says it is also working on open-source plugins for CoCo but has not named repositories or versions. Its CCM release notes from 17 September added CoCo application registration for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel Trust Domain Extensions (TDX).
What to watch: the open-source plugins Fortanix has promised, and whether the GPU attestation setting becomes a standard part of CoCo deployments.
