Confidential Containers Achieves CNCF Incubation Status, Bolstering Data-in-Use Security for Cloud-Native Workloads

The Cloud Native Computing Foundation (CNCF) Technical Oversight Committee (TOC) has officially elevated Confidential Containers to an incubating project, marking a significant milestone in securing sensitive workloads within cloud-native environments. This advancement, announced on July 22, 2026, signifies the project’s robust maturity, active community engagement, and critical role in addressing the often-overlooked challenge of protecting data while it is actively being processed in memory. The move from Sandbox to Incubation underscores the industry’s growing recognition of the imperative to secure data beyond traditional encryption methods for data at rest and in transit, ushering in a new era of "data-in-use" protection.

The Unmet Need: Securing Data in Use

In the modern digital landscape, data security is paramount, driven by increasing cyber threats, stringent regulatory requirements such as GDPR, HIPAA, and PCI DSS, and the inherent risks of processing sensitive information in shared cloud infrastructure. While established practices for encrypting data at rest (storage) and data in transit (network communication) are widely adopted, a significant vulnerability has long persisted: data in use. During computation, data is decrypted and loaded into memory, where it can potentially be exposed to malicious insiders, privileged cloud operators, or sophisticated software attacks. This gap in security has limited the types of highly sensitive workloads that organizations are willing to deploy in public cloud environments, hindering innovation and multi-cloud adoption, particularly for industries like finance, healthcare, government, and defense.

Confidential Containers directly addresses this critical vulnerability by leveraging hardware-based Trusted Execution Environments (TEEs). TEEs create isolated, encrypted enclaves within a CPU, ensuring that data and code remain confidential and unalterable even from the underlying operating system, hypervisor, or cloud provider. This innovative approach allows organizations to process highly sensitive data on third-party infrastructure with cryptographic assurance that the data remains protected throughout its lifecycle, including during computation. It effectively mitigates the risk of unauthorized access or tampering by the infrastructure provider, a crucial factor for compliance and trust in outsourced computing.

A Collaborative Journey: From Inception to Incubation

The journey of Confidential Containers began in 2021 as a collaborative open-source initiative, bringing together leading technology giants such as Red Hat, Intel, IBM, and other industry partners. Their shared vision was to integrate the burgeoning field of confidential computing with the rapidly expanding cloud-native ecosystem, specifically within Kubernetes. By marrying hardware security features with the Kubernetes orchestration platform through the Kata Containers runtime, the project aimed to abstract the complexities of TEEs, making confidential computing accessible to mainstream developers and operations teams. This integration allows developers to deploy confidential workloads using familiar Kubernetes workflows, significantly reducing the adoption barrier for these advanced security capabilities.

The project’s initial entry into the CNCF Sandbox marked its commitment to open governance and community-driven development, providing a neutral home for its growth. The Sandbox stage is designed for nascent projects to foster collaboration and build a community around a promising idea. Confidential Containers leveraged this environment effectively, attracting a diverse array of contributors and major technology organizations.

Key Milestones and Robust Ecosystem Development

Since its inception and subsequent entry into the CNCF Sandbox, Confidential Containers has demonstrated remarkable growth and widespread industry support. Its ecosystem now reflects a vibrant and engaged community, underpinned by significant contributions from across the technology landscape. Major technology organizations and cloud service providers, including Microsoft Azure, Intel, AMD, IBM, NVIDIA, Alibaba, and Red Hat, have actively supported the project, underscoring its strategic importance. These contributions span development, testing, and integration efforts, validating the project’s technical merit and market relevance.

Quantitative metrics vividly illustrate this robust engagement: the project boasts over 1,000 combined GitHub stars across its foundational core organization repositories, indicating broad developer interest and adoption. Furthermore, its development velocity is impressive, with over 1,200 merged pull requests across 26 repository groups, reflecting continuous feature development, bug fixes, and improvements. The sustained activity is also evident in more than 1,500 historical and active tracking issues, demonstrating a transparent and problem-solving oriented community. This extensive activity is driven by a vibrant community of over 150 active contributors, encompassing hardware vendors, hyperscale cloud providers, and security researchers, all collaborating to advance the project. This collective effort has culminated in more than 15 cumulative engineering lifecycle releases, each bringing enhanced stability, features, and broader hardware support.

Beyond its core development, Confidential Containers has matured through seamless integration with the broader Kubernetes ecosystem. It facilitates infrastructure automation via policy engines like Kyverno, enabling organizations to define and enforce security policies for confidential workloads. Crucially, it is also being integrated into KServe, a serverless machine learning platform, to support the emerging and highly sensitive use cases of confidential AI inference. This integration is pivotal for industries dealing with proprietary models or sensitive training data, enabling them to leverage AI in shared environments without compromising data privacy.

The Significance of CNCF Incubation

Achieving Incubation status within the CNCF is a testament to a project’s technical maturity, robust governance, and growing adoption. It signals that a project has moved beyond experimental stages and is considered stable enough for production environments, demonstrating significant traction and a healthy, diverse community. The CNCF TOC, which provides technical leadership to the cloud-native community, rigorously evaluates projects based on criteria such as documentation, test coverage, security best practices, and community engagement.

For Confidential Containers, Incubation means enhanced visibility, increased collaboration opportunities within the CNCF’s vast ecosystem, and a clear path toward becoming a widely adopted industry standard. It reinforces the project’s neutral governance, which is critical for fostering trust and widespread adoption across competing vendors and cloud providers. As Ariel Adam, a Maintainer for Confidential Containers, eloquently stated, "The Confidential Containers community has successfully transformed TEE-backed security from a niche research interest into a robust, production-ready foundation for sensitive Kubernetes workloads. By joining CNCF, we secure the neutral, open governance required to set the industry standard for privacy-preserving infrastructure." This sentiment highlights the project’s transition from a specialized solution to a foundational component of cloud-native security.

Mikko Ylinen, another Maintainer, further emphasized the project’s achievement: "Our community has effectively abstracted the complexity of heterogeneous hardware-level isolation into standard, accessible Kubernetes patterns, ensuring security scales with the stack. Confidential Containers’ transition to incubation allows us to align ‘data-in-use’ protection with the broader cloud native ecosystem, similar to how we’ve standardized critical infrastructure before. We are now delivering the secure, native capability required to deploy use cases such as confidential AI inference at production scale." This statement underscores the project’s success in democratizing complex security technologies and its immediate applicability to high-demand scenarios like AI.

The TOC sponsors also echoed these sentiments. Faseela K, a TOC Sponsor, remarked, "Confidential Containers has demonstrated clear maturity in integrating TEE-backed isolation within standard Kubernetes workflows, earning its place as an incubating project. This transition validates the community’s effort to standardize data-in-use protection, ensuring that security is baked into the infrastructure rather than bolted on as an afterthought." Kevin Wang, another TOC Sponsor, added, "Achieving incubation is the direct result of the project’s robust development history, evidenced by its successful integration across heterogeneous TEE environments. By abstracting complex hardware security into standard Kubernetes patterns, the project allows developers to treat confidential computing as a native capability of their application stack. We’ve done this before with critical infrastructure standards, and this approach will now serve as the secure backbone for the next era of high-intensity, distributed AI inference." These endorsements from TOC members underscore the project’s technical excellence and its strategic importance for the future of cloud computing.

Understanding Confidential Computing and TEEs

To fully appreciate the impact of Confidential Containers, it is crucial to understand the underlying technology of Confidential Computing and TEEs. Confidential Computing represents a paradigm shift in data security, moving beyond traditional perimeter and data-at-rest/in-transit protection to secure data during its most vulnerable state: active processing. TEEs, the hardware foundation for this paradigm, are isolated execution environments that run within the main processor. They provide several key security properties:

• Data Confidentiality: Data loaded into a TEE is encrypted in memory and inaccessible to unauthorized entities, including the operating system, hypervisor, or even firmware.
• Code Integrity: The code running within a TEE is cryptographically verified to ensure it has not been tampered with.
• Attestation: TEEs can provide verifiable proof to remote parties that their code is running in a legitimate, secure environment, offering cryptographic assurance to users and auditors.

While TEEs have existed in various forms (e.g., Intel SGX, AMD SEV, ARM TrustZone), their adoption in cloud-native environments has been challenging due to their low-level nature and hardware-specific APIs. Confidential Containers bridges this gap by providing a standardized, Kubernetes-native interface to these diverse TEE technologies. It achieves this by integrating with Kata Containers, an open-source container runtime that launches virtual machines for each pod, providing strong isolation. Within this Kata VM, Confidential Containers orchestrates the setup of TEEs, encrypting the VM’s memory and ensuring that the container workloads run within the secure enclave. This abstraction allows developers to specify "confidential" as a deployment option, rather than grappling with the intricacies of TEE hardware programming.

Architectural Overview and Key Components

While the original article did not list specific sub-components, the Confidential Containers project, by its nature, comprises several integrated elements that collectively deliver its security promise. These include:

• Runtime Integration Layer: This layer, built upon Kata Containers, facilitates the creation and management of confidential virtual machines (CVMs) or confidential containers. It translates Kubernetes container specifications into secure TEE-enabled execution environments.
• TEE Orchestration and Management: Components responsible for interacting with underlying hardware TEEs (e.g., Intel SGX, AMD SEV, IBM PEF) to provision secure enclaves, manage encryption keys, and perform attestation.
• Key Management System (KMS) Integration: Securely manages and distributes cryptographic keys necessary for encrypting and decrypting data within TEEs. This often involves integration with external KMS solutions or specialized key brokers.
• Attestation Service: Provides mechanisms for verifying the integrity and authenticity of the TEE environment to a requesting party. This is crucial for establishing trust in the confidential workload.
• Policy Enforcement: Integration points with tools like Kyverno to define and enforce security policies, ensuring that only authorized and correctly configured confidential workloads are deployed.
• Image Management and Sealing: Mechanisms to securely deliver container images and secrets into the TEE, often involving cryptographic sealing to prevent tampering.

These components work in concert to ensure an end-to-end confidential computing pipeline, from workload deployment to execution, all managed through familiar Kubernetes constructs.

Roadmap for Future Development and Broader Impact

The future roadmap for Confidential Containers is strategically divided into short-term (2-6 months) and mid-to-long-term (6-18 months) objectives, reflecting a commitment to both immediate stability and future innovation. The short-term focus is on delivering an end-to-end, stable, and easy-to-deploy solution. This involves refining existing features, enhancing user experience, and broadening hardware compatibility. Development in this phase is meticulously tracked across dedicated GitHub projects, including a "release project" for version-specific development and a "Trustee project" for ongoing implementation requirements, ensuring clarity and progress tracking.

The mid-to-long-term roadmap shifts towards a use-case-driven development approach. Rather than merely adding features, the project aims to deliver complete solutions for real-world customer requirements, such as expanding confidential AI capabilities, enabling secure multi-party computation, or facilitating confidential data analytics. This customer-centric approach is supported by a strong emphasis on robust CI/CD processes, ensuring consistent end-to-end functionality and reliability for production deployments. The full project roadmap is publicly available on its GitHub repository, providing transparency and inviting community contributions.

As a CNCF-hosted project, Confidential Containers benefits from being part of a neutral foundation aligned with its technical interests, as well as the broader Linux Foundation, which provides governance, marketing support, and community outreach. This institutional backing is crucial for its long-term sustainability and for establishing it as a de facto standard. Confidential Containers now joins an esteemed list of other incubating technologies within the CNCF, including Backstage, Buildpacks, Chaos Mesh, Container Network Interface (CNI), Contour, Cortex, CubeFS, Emissary-Ingress, gRPC, HAMi, in-toto, Keptn, Keycloak, KubeEdge, Kubeflow, KubeVela, KubeVirt, Litmus, Longhorn, NATS, Notary, OpenFeature, OpenKruise, OpenMetrics, Operator Framework, Thanos, and Volcano. Its progression through the CNCF maturity levels, with Graduation as the ultimate goal, will continue to be guided by rigorous criteria focusing on adoption, community health, and technical stability.

The implications of Confidential Containers achieving Incubation status are far-reaching. It signals a critical step towards mainstream adoption of confidential computing in cloud-native architectures. This advancement empowers enterprises across regulated industries to confidently migrate sensitive workloads to public and hybrid clouds, unlocking new levels of agility, scalability, and cost efficiency. It will accelerate the development of innovative applications that rely on processing sensitive data, such as confidential machine learning, secure data analytics, and privacy-preserving multi-party computation. By standardizing data-in-use protection within the Kubernetes ecosystem, Confidential Containers is not just a project; it is a foundational pillar for the next generation of secure, privacy-preserving cloud infrastructure.

To learn more about Confidential Containers and get involved, visit confidentialcontainers.org, explore the GitHub repository, or join the vibrant community on the #confidential-containers Slack channel.