Fortanix has added Confidential Containers support to its Confidential AI platform, according to infoq.com. The integration links attestation of Kubernetes workloads to the release of encryption keys, so that a workload passing its security checks can unlock models and sensitive data inside hardware-backed trusted execution environments (TEEs). InfoQ reported the announcement on 31 October 2026.
Confidential Containers, known as CoCo, is a Cloud Native Computing Foundation project. It runs Kubernetes pods inside confidential virtual machines that rely on hardware-based TEEs. Ordinary containers depend mostly on the host operating system for isolation; confidential VMs use hardware protections to encrypt memory and limit who can reach a workload while it runs.
Why it matters
The approach extends protection to data while it is being processed, not only while it sits in storage or crosses a network. That can allow organisations to run sensitive jobs on shared infrastructure. InfoQ notes that these protections still rest on trusting the guest software and on getting attestation and key release configured correctly.
Fortanix's technical overview, as reported by infoq.com, describes plugins that connect CoCo workloads to two services. The Confidential Computing Manager (CCM) checks the environment. The Data Security Manager (DSM) hands out keys only to environments that CCM has already verified. Fortanix says CCM can attest the processor and the graphics processing unit (GPU) together, a check that depends on how it is configured.
In CoCo, image pulling and unpacking happen inside the confidential guest. Its Attestation Agent gathers hardware evidence, and its Confidential Data Hub retrieves secrets once verification succeeds. Under the workflow Fortanix describes, keys remain in DSM when attestation fails, which means the workload cannot decrypt the models or data it was meant to protect.
How the pieces fit together
Anuj Jaiswal, Fortanix's chief product officer, said in the announcement that putting attestation and key management on one platform lets teams adopt standard CoCo without having to build the trust layer on their own. According to infoq.com, Fortanix says CCM and DSM run in a clustered setup with round-the-clock support, and can be delivered as a hosted service, on premises, or in an air-gapped environment.
Fortanix's deployment guide for Intel TDX lists two GPU settings. One, labelled Required, has CCM validate GPU evidence through NVIDIA's attestation service. The other, labelled Ignored, only confirms that evidence exists and sets aside the result. The same guide states that the Fortanix CoCo Helm chart does not set host firmware or kernel parameters, which have to be handled before installation.
Attestation paired with conditional secret delivery is not new to CoCo. Its open-source Trustee components already provide it. Trustee keeps evidence appraisal separate from resource authorisation: its attestation service compares platform claims against reference values, and then its Key Broker Service applies a policy defined by the user before releasing secrets from local storage, a plugin, or an external key store. Even a successful attestation needs that policy to approve the request. Trustee also accepts GPU evidence that is bound to the processor's attestation report.
For teams that prefer a managed route, Microsoft's Azure Secure Key Release is available in Key Vault Premium and Managed HSM and works with Azure Attestation. InfoQ points out that it releases exportable keys rather than secrets or certificates.
Limits of the trust boundary
The guest kernel and helper processes inside the pod fall within the trust boundary, so teams have to trust them as well. CoCo's trust model, as described by infoq.com, says hardware measurements typically cover the guest environment, while container verification is a separate step. It also cautions that an enclave application can still expose a risky external interface, and it does not cover denial-of-service protection or hardware side channels. Attestation on its own does not show that an AI application handles data safely.
Fortanix says CoCo support is available now, and its deployment guide covers installing the Fortanix CoCo Helm chart. The announcement also states that Fortanix is working on open-source plugins for CoCo, though it does not name repositories or versions. Release notes for CCM dated 17 September added CoCo application registration for AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) and Intel Trust Domain Extensions (TDX).
Watch whether Fortanix publishes the open-source CoCo plugins it says are in development, and how the Required and Ignored GPU settings are used in practice.
