dstack-capsule: Pod-Level Remote Attestation for Confidential Workloads on Kubernetes
2026-06-02 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors address the challenge of securely verifying individual container workloads (Pods) in cloud environments without needing one virtual machine (VM) per Pod, which is resource-heavy. They created dstack-capsule, a Kubernetes system that uses Intel TDX to let multiple Pods share a Confidential VM while giving each Pod its own hardware-backed proof of identity. Their approach involves a two-layer verification system with static platform checks and dynamic, Pod-specific signatures on each request. They also provide a complete open-source implementation and show it can securely verify Pods without the usual VM overhead.
Confidential ComputingKubernetesPod-level Remote AttestationIntel TDXVirtual Machines (VMs)Confidential Containers (CoCo)Hardware-backed IdentityRTMRSysboxSandboxing
Authors
Yang Yang, Kevin Wang, Yuanhai Luo, Hang Yin, Jie Cai, Shunfan Zhou, Wenfeng Wang
Abstract
The rise of LLM-as-a-Service and other confidential cloud workloads demands cryptographic proof that user data is processed in a trusted, untampered environment. Existing solutions, notably Confidential Containers (CoCo), enforce a strict "one Pod per VM" model that attests only the Guest OS stack, leaving container-level identity unverified and incurring prohibitive per-VM resource overhead. We present dstack-capsule, a Kubernetes platform that enables Pod-level remote attestation on Intel TDX by allowing multiple Pods to share a single Confidential VM while each retains independent, hardware-backed proof of identity. Our key insight is a two-layer attestation architecture: static platform measurements are frozen in RTMR[3] via an irreversible privilege fuse, while dynamic Pod identities (pod_uid, pod_spec_hash, workload_id) are embedded in the TDX Quote's report_data field and signed by hardware on every request. dstack-capsule introduces (1) a Pod-level attestation protocol binding Pod spec digests to hardware-signed Quotes; (2) a privilege fuse mechanism that atomically transitions a node from setup mode to secure mode; (3) a multi-layer sandbox spanning storage, runtime, admission, API, and network isolation layers; and (4) a complete open-source implementation based on Kubernetes 1.32, Intel TDX, and Sysbox. We evaluate the security properties, attestation correctness, and performance characteristics of dstack-capsule, demonstrating that it achieves Pod-granularity verification without the resource overhead of per-VM isolation.