Shielded but Lightweight: Building Practical Confidential Containers with ARM CCA
2026-05-25 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors discuss the need for better security in cloud containers that share resources with others. They note that current designs use microVMs, which are secure but slow to start and use a lot of resources. To fix this, they created Fasco, a simpler container system that uses special ARM hardware (CCA) to keep data safe while starting faster and using fewer resources. They tested Fasco and found it is quicker and more efficient than previous methods while staying secure.
confidential containersmicroVMARM Confidential Compute Architecture (CCA)container runtimeisolationmulti-tenant environmentsstartup latencytrusted computing base (TCB)hardware-enforced securityresource management
Authors
Liantao Song, Yiming Zhang, Fengwei Zhang, Yan Ding, Bin Zhou, Jie Yu, Yusong Tan
Abstract
The rapid advancement of cloud-native technologies has created an urgent need for security. Currently, confidential containers are increasingly deployed in multi-tenant environments. Existing confidential container designs mainly adopt a microVM-based architecture. Although this approach improves inter-container isolation, its complex software stack leads to high startup latency and significant resource overhead, making it unsuitable for short-lived container workloads. In this paper, we propose Fasco, a lightweight confidential container runtime based on the ARM Confidential Compute Architecture (CCA). Fasco directly instantiates each container as an independent Container Realm, leveraging CCA's hardware-enforced isolation to ensure the confidentiality and integrity of application data inside the container. In addition, Fasco introduces a dedicated System Realm to provide system services and resource management for container realms. Through exception forwarding and shared buffers, Fasco ensures isolation among different container realms. We have implemented a prototype of Fasco and evaluated its performance on ARMv8 hardware. Experimental results show that Fasco reduces the startup latency and performance overhead of existing confidential container architectures while maintaining a small TCB.