> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/confidential-computing/containers/dev/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/confidential-computing/_mcp/server. # Dev ## Docs - [NVIDIA Confidential Containers Reference Architecture](https://docs.nvidia.com/confidential-computing/containers/dev/overview.md): This documentation describes NVIDIA’s reference architecture for deploying CNCF Confidential Containers on compliant Confidential Computing hardware and software. - [Personas](https://docs.nvidia.com/confidential-computing/containers/dev/personas.md): This page provides an overview of the prior knowledge recommended before implementing the architecture, the personas who own each part of the deployment, and how to navigate this documentation. - [Supported Platforms and Software Components](https://docs.nvidia.com/confidential-computing/containers/dev/supported-platforms.md): Following are the platforms supported by the NVIDIA Confidential Containers Reference Architecture. - [Prerequisites](https://docs.nvidia.com/confidential-computing/containers/dev/prerequisites.md): As a Kubernetes Cluster Administrator, prepare hosts and the Kubernetes cluster before you install Kata Containers and the NVIDIA GPU Operator. - [Quickstart Install](https://docs.nvidia.com/confidential-computing/containers/dev/install-quickstart.md): As a Kubernetes Cluster Administrator, use these steps to install Kata Containers and the NVIDIA GPU Operator with minimal steps. - [Detailed Install Guide](https://docs.nvidia.com/confidential-computing/containers/dev/confidential-containers-deploy.md): As a Kubernetes Cluster Administrator, use these steps to deploy Kata Containers and the NVIDIA GPU Operator to your cluster and configure it for Confidential Containers. - [Run a Sample Workload](https://docs.nvidia.com/confidential-computing/containers/dev/run-sample-workload.md): As a Kubernetes Cluster Administrator, use this page to verify your installation and run a sample workload. - [Configuring Confidential Container Workloads](https://docs.nvidia.com/confidential-computing/containers/dev/configure-workloads.md): As a Container User, use this page to configure confidential GPU workloads on a prepared cluster. - [Managing the Confidential Computing Mode](https://docs.nvidia.com/confidential-computing/containers/dev/configure-cc-mode.md): As a Kubernetes Cluster Administrator, use this page to configure the confidential computing mode of NVIDIA GPUs in your cluster. - [Attestation](https://docs.nvidia.com/confidential-computing/containers/dev/attestation.md): As a Security Engineer, use this page to understand attestation concepts and stand up a local Trustee instance for testing. - [Troubleshooting](https://docs.nvidia.com/confidential-computing/containers/dev/troubleshooting.md): Use this page when Confidential Containers installation or workload deployment steps fail. - [Release Notes](https://docs.nvidia.com/confidential-computing/containers/dev/release-notes.md): This document describes the new features and known issues for the NVIDIA Confidential Containers Reference Architecture. - [Licensing](https://docs.nvidia.com/confidential-computing/containers/dev/licensing.md): NVIDIA Confidential Computing is a licensed feature for production use. > **Note:** This page contains both a page directory (above) and the landing page content (below). The page directory is generated for agent use and does not appear on the landing page. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/confidential-computing/containers/dev/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/confidential-computing/_mcp/server. # NVIDIA Confidential Containers > NVIDIA Confidential Containers is a validated reference architecture for running GPU-accelerated AI workloads on Kubernetes inside hardware-enforced Trusted Execution Environments (TEEs). NVIDIA Confidential Containers is a validated reference architecture for running GPU-accelerated AI workloads on Kubernetes inside hardware-enforced Trusted Execution Environments (TEEs). It extends NVIDIA GPU Confidential Computing to standard Kubernetes deployments using CNCF [Confidential Containers](https://confidentialcontainers.org/) and Kata Containers with the NVIDIA GPU Operator. Use it to protect model intellectual property and sensitive data from untrusted infrastructure across public cloud, on-premises, and edge deployments. ## Benefits Confidential Containers provides the following benefits: * Protect model IP and sensitive data on untrusted public cloud, on-premises, or edge infrastructure. * Deploy proprietary generative AI models in regulated industries on third-party or private clusters. * Isolate GPU workloads in hardware-protected enclaves with encrypted memory and integrity verification. * Operate confidential workloads with standard Kubernetes pods, runtime classes, and scheduling. * Verify TEE state through remote attestation before releasing secrets or decrypted model weights. Refer to [Reference Architecture](/confidential-computing/containers/dev/overview) for background, use cases, and architecture diagrams. ### Use Cases Common scenarios include protecting proprietary model IP on third-party infrastructure, running frontier models in a sovereign environment, and processing sensitive enterprise data in data clean rooms. Refer to [Use Cases](/confidential-computing/containers/dev/overview#coco-use-cases) in the Reference Architecture for workflows and deployment scenarios. ## Core Concepts [Confidential Containers](https://confidentialcontainers.org/) runs Kubernetes pods in hardware-isolated virtual machines instead of on the shared host kernel, protecting workloads from the host and other tenants. On supported hardware (AMD SEV-SNP or Intel TDX), that isolation forms a trusted execution environment (TEE) with encrypted memory and integrity verification. Attestation, sealed secrets, and encrypted container images are core to the model. Refer to [Software Components for Confidential Containers](/confidential-computing/containers/dev/overview#coco-supported-platforms-components) in the Reference Architecture. ## Core Components This documentation focuses on the components you install, configure, and operate to run workloads in a Confidential Containers runtime on Kubernetes. The [Reference Architecture](/confidential-computing/containers/dev/overview) describes the full stack. The install guides cover Kata Containers and the NVIDIA GPU Operator end to end. * Kata Containers: Runs pods inside TEE-protected virtual machines instead of on the shared host kernel. Install Kata Deploy and TEE-specific runtime shims in [Quickstart Install](/confidential-computing/containers/dev/install-quickstart) and [Detailed Install Guide](/confidential-computing/containers/dev/confidential-containers-deploy). Schedule workloads with a TEE-aware `RuntimeClass` in [Configuring Workloads](/confidential-computing/containers/dev/configure-workloads). * NVIDIA GPU Operator: Automates GPU Confidential Computing on eligible nodes, including CC mode, VFIO passthrough, and GPU allocation for Kata pods. Configure the Operator and node labels in [Detailed Install Guide](/confidential-computing/containers/dev/confidential-containers-deploy). Manage CC mode in [Managing the Confidential Computing Mode](/confidential-computing/containers/dev/configure-cc-mode). For Confidential Containers, the Operator deploys: * NVIDIA Confidential Computing Manager (cc-manager) * NVIDIA Kata Sandbox Device Plugin * NVIDIA VFIO Manager * Node Feature Discovery (NFD) ## Using This Documentation This documentation describes the NVIDIA reference architecture for Confidential Containers and deployment recommendations for the upstream [CNCF Confidential Containers project](https://confidentialcontainers.org/) with NVIDIA GPUs. It covers NVIDIA-specific configurations needed to run Confidential Containers workloads on Kubernetes. This primarily includes the steps to enable and configure Kata Containers and the NVIDIA GPU Operator on your cluster. For advanced Confidential Containers topics and day-two operations, refer to the upstream [Confidential Containers documentation](https://confidentialcontainers.org/docs/), as the workflows and implementations are not NVIDIA specific. For example, an attestation implementation is not specific to NVIDIA GPUs. A brief attestation overview and evaluation quickstart is available in [Attestation](/confidential-computing/containers/dev/attestation), but full production attestation implementation guides are in the upstream [Confidential Containers attestation documentation](https://confidentialcontainers.org/docs/attestation/). ## Learn #### [Reference Architecture](/confidential-computing/containers/dev/overview) Use cases, software components, cluster topology, limitations, and security considerations. #### [Personas](/confidential-computing/containers/dev/personas) Roles, responsibilities, and documentation navigation by persona. #### [Supported Platforms and Software Components](/confidential-computing/containers/dev/supported-platforms) Validated hardware, OS, and component versions. ## Install #### [Prerequisites](/confidential-computing/containers/dev/prerequisites) Hardware, BIOS, and Kubernetes cluster requirements. #### [Quickstart Install](/confidential-computing/containers/dev/install-quickstart) Minimal steps to install Kata Containers and the GPU Operator. #### [Detailed Install Guide](/confidential-computing/containers/dev/confidential-containers-deploy) Install with per-node labeling, configuration options, and troubleshooting. #### [Run a Sample Workload](/confidential-computing/containers/dev/run-sample-workload) Run a sample GPU workload; success is `Test PASSED` in the pod logs. ## Configuration #### [Configuring Workloads](/confidential-computing/containers/dev/configure-workloads) Runtime classes, resource types, multi-GPU passthrough, and agent security policy. #### [Managing the Confidential Computing Mode](/confidential-computing/containers/dev/configure-cc-mode) Set CC mode at the cluster or node level. #### [Attestation](/confidential-computing/containers/dev/attestation) Attestation concepts and a Trustee quickstart for connectivity testing.