> This page is for Confidential Containers, version v1.0.0.
> For other versions, use one of these documentation indexes:
> - v1.1.0 (default): https://docs.nvidia.com/confidential-computing/containers/v1.1.0/llms.txt
> - v1.0.0: https://docs.nvidia.com/confidential-computing/containers/v1.0.0/llms.txt
> - Dev: https://docs.nvidia.com/confidential-computing/containers/dev/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/confidential-computing/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/confidential-computing/_mcp/server.

# NVIDIA Confidential Containers

> NVIDIA Confidential Containers is a validated reference architecture for running GPU-accelerated AI workloads on Kubernetes inside hardware-enforced Trusted Execution Environments (TEEs).

NVIDIA Confidential Containers is a validated reference architecture for running GPU-accelerated AI workloads on Kubernetes inside hardware-enforced Trusted Execution Environments (TEEs).
It extends NVIDIA GPU Confidential Computing to standard Kubernetes deployments using CNCF [Confidential Containers](https://confidentialcontainers.org/) and Kata Containers with the NVIDIA GPU Operator.
Use it to protect model intellectual property and sensitive data from untrusted infrastructure across public cloud, on-premises, and edge deployments.

## Benefits

Confidential Containers provides the following benefits:

* Protect model IP and sensitive data on untrusted public cloud, on-premises, or edge infrastructure.

* Deploy proprietary generative AI models in regulated industries on third-party or private clusters.

* Isolate GPU workloads in hardware-protected enclaves with encrypted memory and integrity verification.

* Operate confidential workloads with standard Kubernetes pods, runtime classes, and scheduling.

* Verify TEE state through remote attestation before releasing secrets or decrypted model weights.

Refer to [Reference Architecture](/confidential-computing/containers/v1.0.0/overview) for background, use cases, and architecture diagrams.

### Use Cases

Common scenarios include protecting proprietary model IP on third-party infrastructure, running frontier models in a sovereign environment, and processing sensitive enterprise data in data clean rooms.
Refer to [Use Cases](/confidential-computing/containers/v1.0.0/overview#coco-use-cases) in the Reference Architecture for workflows and deployment scenarios.

## Core Concepts

[Confidential Containers](https://confidentialcontainers.org/) runs Kubernetes pods in hardware-isolated virtual machines instead of on the shared host kernel, protecting workloads from the host and other tenants.
On supported hardware (AMD SEV-SNP or Intel TDX), that isolation forms a trusted execution environment (TEE) with encrypted memory and integrity verification.

Attestation, sealed secrets, and encrypted container images are core to the model.
Refer to [Software Components for Confidential Containers](/confidential-computing/containers/v1.0.0/overview#coco-supported-platforms-components) in the Reference Architecture.

## Core Components

This documentation focuses on the components you install, configure, and operate to run workloads in a Confidential Containers runtime on Kubernetes.
The [Reference Architecture](/confidential-computing/containers/v1.0.0/overview) describes the full stack.
The install guides cover Kata Containers and the NVIDIA GPU Operator end to end.

* Kata Containers: Runs pods inside TEE-protected virtual machines instead of on the shared host kernel.
  Install Kata Deploy and TEE-specific runtime shims in [Quickstart Install](/confidential-computing/containers/v1.0.0/install-quickstart) and [Detailed Install Guide](/confidential-computing/containers/v1.0.0/confidential-containers-deploy).
  Schedule workloads with a TEE-aware `RuntimeClass` in [Configuring Workloads](/confidential-computing/containers/v1.0.0/configure-workloads).

* NVIDIA GPU Operator: Automates GPU Confidential Computing on eligible nodes, including CC mode, VFIO passthrough, and GPU allocation for Kata pods.
  Configure the Operator and node labels in [Detailed Install Guide](/confidential-computing/containers/v1.0.0/confidential-containers-deploy).
  Manage CC mode in [Managing the Confidential Computing Mode](/confidential-computing/containers/v1.0.0/configure-cc-mode).

  For Confidential Containers, the Operator deploys:

  * NVIDIA Confidential Computing Manager (cc-manager)

  * NVIDIA Kata Sandbox Device Plugin

  * NVIDIA VFIO Manager

  * Node Feature Discovery (NFD)

## Using This Documentation

This documentation describes the NVIDIA reference architecture for Confidential Containers and deployment recommendations for the upstream [CNCF Confidential Containers project](https://confidentialcontainers.org/) with NVIDIA GPUs.
It covers NVIDIA-specific configurations needed to run Confidential Containers workloads on Kubernetes.
This primarily includes the steps to enable and configure Kata Containers and the NVIDIA GPU Operator on your cluster.

For advanced Confidential Containers topics and day-two operations, refer to the upstream [Confidential Containers documentation](https://confidentialcontainers.org/docs/), as the workflows and implementations are not NVIDIA specific.
For example, an attestation implementation is not specific to NVIDIA GPUs.
A brief attestation overview and evaluation quickstart is available in [Attestation](/confidential-computing/containers/v1.0.0/attestation), but full production attestation implementation guides are in the upstream [Confidential Containers attestation documentation](https://confidentialcontainers.org/docs/attestation/).

## Learn

#### [Reference Architecture](/confidential-computing/containers/v1.0.0/overview)

Use cases, software components, cluster topology, limitations, and security considerations.

#### [Personas](/confidential-computing/containers/v1.0.0/personas)

Roles, responsibilities, and documentation navigation by persona.

#### [Supported Platforms](/confidential-computing/containers/v1.0.0/supported-platforms)

Validated hardware, OS, and component versions.

## Install

#### [Prerequisites](/confidential-computing/containers/v1.0.0/prerequisites)

Hardware, BIOS, and Kubernetes cluster requirements.

#### [Quickstart Install](/confidential-computing/containers/v1.0.0/install-quickstart)

Minimal steps to install Kata Containers and the GPU Operator.

#### [Detailed Install Guide](/confidential-computing/containers/v1.0.0/confidential-containers-deploy)

Install with per-node labeling, configuration options, and troubleshooting.

#### [Run a Sample Workload](/confidential-computing/containers/v1.0.0/run-sample-workload)

Run a sample GPU workload; success is `Test PASSED` in the pod logs.

## Configuration

#### [Configuring Workloads](/confidential-computing/containers/v1.0.0/configure-workloads)

Runtime classes, resource types, and multi-GPU passthrough.

#### [Managing the Confidential Computing Mode](/confidential-computing/containers/v1.0.0/configure-cc-mode)

Set CC mode at the cluster or node level.

#### [Attestation](/confidential-computing/containers/v1.0.0/attestation)

Attestation concepts and a Trustee quickstart for connectivity testing.