{"slug": "how-confidential-containers-lock-down-ai-on-kubernetes-2026", "title": "How Confidential Containers Lock Down AI on Kubernetes [2026]", "summary": "Fortanix added support for the CNCF Confidential Containers (CoCo) project to Fortanix Confidential AI on October 19, pairing the open-source runtime with its own attestation and key management services so AI workloads run inside hardware-isolated trusted execution environments on Kubernetes. A Fortanix-commissioned Atomik Research survey of 300 AI leaders in banking, financial services, healthcare, insurance and government found 93% understood traditional encryption does not protect data during AI processing, but only half could fully verify that protection during inference. Fortanix Confidential Computing Manager performs composite CPU-and-GPU attestation before Fortanix Data Security Manager, a FIPS 140-2 Level 3 HSM and key manager, releases decryption keys into the protected environment; CoCo joined the CNCF in March 2022 and reached Incubating status in July 2026.", "body_md": "Kubernetes has become a standard way to ship AI services, but it carries an old blind spot into the AI era: while a model is running, its weights and the data it reads sit decrypted in memory. Fortanix’s latest release puts that problem in focus. On October 19 the company added support for the CNCF Confidential Containers project, known as CoCo, to [Fortanix Confidential AI](https://www.fortanix.com/platform/confidential-ai), pairing the open-source runtime with its own attestation and key management services.\n\nHere is what Confidential Containers does, how a protected AI workload starts under Fortanix’s setup, and what to check before trying it.\n\n## The problem: data in use\n\nMost security stacks encrypt data at rest and in transit. The gap is the moment of processing. During inference without confidential computing, model weights and sensitive inputs have to be decrypted in CPU and GPU memory, where privileged administrators, cloud operators or anyone with access to the host could get at them.\n\nThe gap is widely understood but often left open. In a Fortanix-commissioned Atomik Research survey of 300 AI leaders in banking, financial services, healthcare, insurance and government, 93% understood that traditional encryption does not protect data while AI is processing it, yet only half could fully verify that protection during inference.\n\n## What Confidential Containers actually does\n\nConfidential Containers is an open-source CNCF project for running containers inside trusted execution environments (TEEs), hardware-isolated environments where memory is encrypted and shielded from the host. The project standardizes confidential computing at the Kubernetes pod level and brings different hardware platforms and cloud offerings into one framework. It joined the CNCF in March 2022 and reached Incubating status in July 2026.\n\nTwo mechanisms do the real work:\n\n- **Attestation:** hardware-backed proof that a workload is running on genuine TEE hardware and has not been altered.\n- **Secure key release:** the keys that decrypt a model or dataset are handed over only after attestation succeeds, and only into the protected environment.\n\nFortanix’s release is about making those two steps hold up in production.\n\n## How a confidential AI workload starts\n\nBased on how Fortanix describes its CoCo integration, the sequence looks like this:\n\n1. A team deploys an AI workload, such as a model server or an agent, as containers on a Kubernetes cluster with TEE-capable CPUs and, for GPU inference, GPUs with confidential computing enabled.\n2. CoCo starts the workload inside a TEE.\n3. Fortanix Confidential Computing Manager (CCM) performs hardware-rooted attestation. The CPU and GPU are verified together, which Fortanix calls composite attestation, so the full execution path is checked.\n4. The workload is checked against security policy: the container has to be genuine, running inside a TEE and compliant with the rules.\n5. Only then does Fortanix Data Security Manager (DSM), a FIPS 140-2 Level 3 HSM and key manager, release the keys into the protected environment.\n6. The model and data are decrypted inside the TEE, and inference runs there.\n\nFortanix is developing open-source plugins that connect CCM and DSM to CoCo, working within the project’s standard workflows rather than replacing them. “Attestation is a protocol. Trust is an operation,” said Anuj Jaiswal, chief product officer at Fortanix. “With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves.”\n\n## Why model owners care, too\n\nConfidential computing is usually framed as protection for whoever owns the data. Fortanix is also pitching it to whoever owns the model. The same trusted environment, the company says, lets enterprises run proprietary models from frontier AI labs on-premises or in air-gapped environments, next to their most sensitive data, without exposing the lab’s intellectual property. In Jaiswal’s words, the model owner’s IP and the enterprise data are protected so that “neither is exposed to the other or to the infrastructure provider.”\n\nNVIDIA made the same point. “Enterprises need data to stay protected while running models and agents, and labs need the same privacy to protect their models,” said John Fanelli, vice president of enterprise software at NVIDIA.\n\n## What Fortanix adds on top of open source\n\nCoCo itself is open source. Fortanix is selling the operational layer around it:\n\n- A clustered deployment designed so key release never becomes a single point of failure.\n- SLA-backed, 24×7 global support.\n- FIPS 140-2 Level 3, SOC 2 Type 2 and ISO/IEC 27001 certifications.\n- SaaS, on-premises and fully air-gapped deployment, for regulated, sovereign and disconnected environments.\n\nFortanix co-founder and CEO Anand Kashyap said the goal is for teams to “deploy containers into confidential computing environments with one click across supported hardware and Kubernetes platforms, with every workload verified before a single key is released.”\n\nThe vendor list around the launch is long. Fortanix’s announcement names NVIDIA, Intel, AMD, Microsoft, Red Hat, Cisco and CrowdStrike among the companies supporting CNCF Confidential Containers. It also lists Fujitsu, whose [MONAKA CPU is aimed at sovereign AI servers](https://shattered.io/fujitsu-monaka-cpu-sovereign-ai-server-2026/), as part of the ecosystem bringing confidential AI to enterprises.\n\n## Before you try it\n\n- **Check the hardware.** You need TEE-capable CPUs, plus GPUs with confidential computing enabled for protected inference. Fortanix currently lists Azure and Google as supported public clouds, and it also offers on-premises and air-gapped deployment.\n- **Write the policy first.** Decide what a workload has to prove before it gets keys. Attestation is only as useful as the policy that checks it.\n- **Treat key release as critical infrastructure.** If the service that verifies workloads and releases keys is down, protected pods cannot start, so plan for its availability from day one.\n- **Keep the other layers.** Confidential computing protects data in use. It does not replace[network policy and zero-trust segmentation](https://shattered.io/kubernetes-network-policy-zero-trust-2026/) , or careful GPU capacity planning now that[Kubernetes 1.37 can scale GPUs to zero](https://shattered.io/kubernetes-1-37-scale-to-zero-gpu-cost-2026/) .\n\nFortanix Confidential AI for CoCo is available now, and the company will demo Confidential AI on supported NVIDIA GPUs with confidential computing enabled at NVIDIA GTC Berlin, booth 7017, from October 20 to 22.", "url": "https://wpnews.pro/news/how-confidential-containers-lock-down-ai-on-kubernetes-2026", "canonical_source": "https://shattered.io/confidential-containers-ai-kubernetes-fortanix-2026/", "published_at": "2026-10-19 12:23:33+00:00", "updated_at": "2026-10-19 12:44:56.676515+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "artificial-intelligence"], "entities": ["Fortanix", "Confidential Containers", "CNCF", "Fortanix Confidential AI", "Fortanix Confidential Computing Manager", "Fortanix Data Security Manager", "Anuj Jaiswal", "Atomik Research"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-confidential-containers-lock-down-ai-on-kubernetes-2026", "markdown": "https://wpnews.pro/news/how-confidential-containers-lock-down-ai-on-kubernetes-2026.md", "text": "https://wpnews.pro/news/how-confidential-containers-lock-down-ai-on-kubernetes-2026.txt", "jsonld": "https://wpnews.pro/news/how-confidential-containers-lock-down-ai-on-kubernetes-2026.jsonld"}}