> This page is for Confidential Containers, version Dev. > For other versions, use one of these documentation indexes: > - v1.1.0 (default): https://docs.nvidia.com/confidential-computing/containers/v1.1.0/llms.txt > - v1.0.0: https://docs.nvidia.com/confidential-computing/containers/v1.0.0/llms.txt > - Dev: https://docs.nvidia.com/confidential-computing/containers/dev/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/confidential-computing/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/confidential-computing/_mcp/server. # Quickstart Install > As a Kubernetes Cluster Administrator, use these steps to install Kata Containers and the NVIDIA GPU Operator with minimal steps. As a [Kubernetes Cluster Administrator](/confidential-computing/containers/dev/personas#coco-persona-kubernetes-cluster-administrator), use these steps to install Kata Containers and the NVIDIA GPU Operator with minimal steps. For additional configuration options and install details, refer to the [Detailed Install Guide](/confidential-computing/containers/dev/confidential-containers-deploy). This quickstart will configure every node in your cluster for Confidential Containers workloads. This is ideal for evaluation or dedicated Confidential Containers clusters. If you need to run Confidential Containers on only some nodes while keeping traditional GPU workloads on others, or you want more control over the installation, use the [Label Nodes for Confidential Containers Components](/confidential-computing/containers/dev/confidential-containers-deploy#coco-label-nodes) section in the [Detailed Install Guide](/confidential-computing/containers/dev/confidential-containers-deploy). This quickstart takes approximately 10 minutes to complete. > **Note** > > Before starting, make sure your cluster meets the [Prerequisites](/confidential-computing/containers/dev/prerequisites). ## What You Will Build By the end of this quickstart, you will have: * Kata Containers running on your cluster. * The NVIDIA GPU Operator installed and configured for Confidential Containers. * All cluster nodes configured for Confidential Containers workloads. ### Install the Kata Containers Helm Chart 1. Set the chart version and registry path: ```console export VERSION="4.0.0" export CHART="oci://ghcr.io/kata-containers/kata-deploy-charts/kata-deploy" ``` 2. Create a values file, such as `kata-nvidia-gpu-values.yaml`, to configure the `kata-deploy` chart for NVIDIA Confidential Containers: ```yaml title={"kata-nvidia-gpu-values.yaml"} # Example values file to enable NVIDIA GPU shims for the NVIDIA # Confidential Containers Reference Architecture. # Set to true for verbose kata-deploy and Kata runtime logging. debug: false deploymentMode: daemonset # Disable Node Feature Discovery (NFD) deployment by kata-deploy. # Both kata-deploy and the GPU Operator can deploy NFD. This reference # architecture relies on the NFD instance that the GPU Operator deploys # and manages, so the kata-deploy NFD subchart is turned off to avoid a # duplicate, conflicting deployment. node-feature-discovery: enabled: false # Install the nydus snapshotter on each node alongside containerd. # The confidential -snp and -tdx shims below use nydus to pull container # images directly into the confidential VM (guest pull), which keeps image # contents inside the trusted execution environment (TEE). snapshotter: setup: ["nydus"] # Disable the chart's default hypervisor/TEE shims and opt in only to # the NVIDIA GPU shims supported by this reference architecture. shims: disableAll: true # Non-confidential NVIDIA GPU passthrough shim used when Confidential # Computing mode is off on the node. The runtime class is restricted to # nodes where the GPU Operator's Confidential Computing Manager has # reported nvidia.com/cc.ready.state=false, so it will not schedule on # CC-ready nodes. The empty containerd snapshotter falls back to the # default (overlayfs); guest pull is not used for this non-confidential # path. qemu-nvidia-gpu: enabled: true supportedArches: - amd64 allowedHypervisorAnnotations: [] containerd: snapshotter: "" runtimeClass: # This label is automatically added by the GPU Operator. nodeSelector: nvidia.com/cc.ready.state: "false" # Confidential NVIDIA GPU passthrough for AMD SEV-SNP nodes. # Scheduled where the GPU Operator reports CC mode is on AND NFD # reports SEV-SNP support. Set agent.httpsProxy / agent.noProxy if # the guest needs a proxy to reach the registry. qemu-nvidia-gpu-snp: enabled: true supportedArches: - amd64 allowedHypervisorAnnotations: [] containerd: snapshotter: "nydus" forceGuestPull: false crio: guestPull: true agent: httpsProxy: "" noProxy: "" runtimeClass: # These labels are automatically added by the GPU Operator and NFD # respectively. nodeSelector: nvidia.com/cc.ready.state: "true" amd.feature.node.kubernetes.io/snp: "true" # Confidential NVIDIA GPU passthrough for Intel TDX nodes. # Same selectors and snapshotter behavior as the SNP shim above, # but pinned to TDX-capable hosts. qemu-nvidia-gpu-tdx: enabled: true supportedArches: - amd64 allowedHypervisorAnnotations: [] containerd: snapshotter: "nydus" forceGuestPull: false crio: guestPull: true agent: httpsProxy: "" noProxy: "" runtimeClass: # These labels are automatically added by the GPU Operator and NFD # respectively. nodeSelector: nvidia.com/cc.ready.state: "true" intel.feature.node.kubernetes.io/tdx: "true" # Default shim when a pod does not request a runtime class. Set to the # non-confidential shim so pods only run in a confidential VM when # they explicitly request the -snp or -tdx runtime class. defaultShim: amd64: qemu-nvidia-gpu # Can be changed to qemu-nvidia-gpu-snp or qemu-nvidia-gpu-tdx if preferred # Create one Kubernetes RuntimeClass per enabled shim above # (kata-qemu-nvidia-gpu, kata-qemu-nvidia-gpu-snp, kata-qemu-nvidia-gpu-tdx). # createDefault: false suppresses the generic "kata" RuntimeClass since # you should always reference a specific NVIDIA shim # by name in pod specs. runtimeClasses: enabled: true createDefault: false defaultName: "kata" ``` 3. Install the `kata-deploy` Helm chart with the values file: ```console helm install kata-deploy "${CHART}" \ --namespace kata-system --create-namespace \ -f kata-nvidia-gpu-values.yaml \ --wait --timeout 10m \ --version "${VERSION}" ``` *Example Output:* ```output Pulled: ghcr.io/kata-containers/kata-deploy-charts/kata-deploy:4.0.0 Digest: sha256:aea41018779716ce2e0bf406d701637d10fb5a0792db51a08dfd3f76701eb933 LAST DEPLOYED: Wed Apr 1 17:03:00 2026 NAMESPACE: kata-system STATUS: deployed REVISION: 1 DESCRIPTION: Install complete TEST SUITE: None ``` It can take 2 to 3 minutes for the command to return and all output to be printed. > **Note** > > There is a [known Helm issue](https://github.com/helm/helm/issues/8660) on single-node clusters that may result in the Helm command finishing before all pods are done initializing. > If you are deploying to a single-node cluster, wait a few additional minutes after the command completes. 4. Verify that the `kata-deploy` pod is running: ```console kubectl get pods -n kata-system | grep kata-deploy ``` *Example Output:* ```output kata-deploy-b2lzs 1/1 Running 0 6m37s ``` A `READY` value of `1/1` and a `STATUS` of `Running` mean the `kata-deploy` pod installed the Kata components on the node. If the pod does not reach `Running`, refer to [View Kata Containers Logs](/confidential-computing/containers/dev/troubleshooting#coco-view-kata-logs) in [Troubleshooting](/confidential-computing/containers/dev/troubleshooting). 5. Verify the `kata-qemu-nvidia-gpu-snp` and `kata-qemu-nvidia-gpu-tdx` runtime classes are available: After `helm install` completes, the `kata-deploy` chart creates the Kata `RuntimeClass` resources on the cluster. This usually happens within 1-2 minutes after the `kata-deploy` pod reaches `Running`. Confirm SNP and TDX classes are present before you continue to [Install the NVIDIA GPU Operator](#quickstart-install-gpu-operator). ```console kubectl get runtimeclass | grep kata-qemu-nvidia-gpu ``` *Example Output:* ```output NAME HANDLER AGE kata-qemu-nvidia-gpu kata-qemu-nvidia-gpu 40s kata-qemu-nvidia-gpu-snp kata-qemu-nvidia-gpu-snp 40s kata-qemu-nvidia-gpu-tdx kata-qemu-nvidia-gpu-tdx 40s ``` If the SNP and TDX runtime classes are not listed immediately, the chart may still be initializing rather than failing. Wait 1-2 minutes and re-run the command. If they are still missing after the `kata-deploy` pod reports `Running`, the install did not complete correctly. On a single-node cluster, retry after a few minutes only if Helm returned before the `kata-deploy` pod reaches `Running` (refer to the note above). Otherwise, refer to [Troubleshooting](/confidential-computing/containers/dev/troubleshooting). **Success criteria:** Helm reports `STATUS: deployed` and both SNP and TDX runtime classes appear in the output above. ### Install the NVIDIA GPU Operator 1. Add and update the NVIDIA Helm repository: ```console helm repo add nvidia https://helm.ngc.nvidia.com/nvidia \ && helm repo update ``` *Example Output:* ```output "nvidia" has been added to your repositories Hang tight while we grab the latest from your chart repositories... ...Successfully got an update from the "nvidia" chart repository Update Complete. ⎈Happy Helming!⎈ ``` 2. Install the GPU Operator configured for Confidential Containers on all nodes: ```console helm install --wait --timeout 10m --generate-name \ -n gpu-operator --create-namespace \ nvidia/gpu-operator \ --set sandboxWorkloads.enabled=true \ --set sandboxWorkloads.defaultWorkload=vm-passthrough \ --set sandboxWorkloads.mode=kata \ --set nfd.enabled=true \ --set nfd.nodefeaturerules=true \ --version=v26.3.1 ``` *Example Output:* ```output NAME: gpu-operator LAST DEPLOYED: Tue Mar 10 17:58:12 2026 NAMESPACE: gpu-operator STATUS: deployed REVISION: 1 TEST SUITE: None ``` It may take 3 to 5 minutes for the Helm release to complete and for all GPU Operator pods to reach the Running state. The `sandboxWorkloads.defaultWorkload=vm-passthrough` flag in the Helm install command sets the default cluster workload type for Confidential Containers. 3. Verify that all GPU Operator pods are running: ```console kubectl get pods -n gpu-operator ``` *Example Output:* ```output NAME READY STATUS RESTARTS AGE gpu-operator-1766001809-node-feature-discovery-gc-75776475sxzkp 1/1 Running 0 86s gpu-operator-1766001809-node-feature-discovery-master-6869lxq2g 1/1 Running 0 86s gpu-operator-1766001809-node-feature-discovery-worker-mh4cv 1/1 Running 0 86s gpu-operator-f48fd66b-vtfrl 1/1 Running 0 86s nvidia-cc-manager-7z74t 1/1 Running 0 61s nvidia-kata-sandbox-device-plugin-daemonset-d5rvg 1/1 Running 0 30s nvidia-sandbox-validator-6xnzc 1/1 Running 0 30s nvidia-vfio-manager-h229x 1/1 Running 0 62s ``` **Success criteria:** All GPU Operator pods are `Running` or `Completed`. Your cluster is now configured to deploy GPU workloads into the SNP and TDX runtime classes on all nodes. ### Next Steps * Continue to [Run a Sample Workload](/confidential-computing/containers/dev/run-sample-workload) to confirm the deployment.