Fortanix has integrated Kubernetes Confidential Containers into its Confidential AI platform, linking workload attestation directly to encryption-key release inside hardware-based trusted execution environments to protect sensitive models and data from infrastructure operators.
Fortanix Confidential AI Connects CNCF Confidential Containers to Hardware-Based Trust
Data security firm Fortanix Inc. has expanded its Fortanix Confidential AI platform to support the Cloud Native Computing Foundation’s Confidential Containers project, known as CoCo. The integration lets organizations run artificial intelligence workloads on Kubernetes inside hardware-based trusted execution environments, keeping models, data, agents, and applications secure while they run.
While standard encryption safeguards information in transit and at rest, artificial intelligence inference typically demands that sensitive information and model weights undergo decryption within CPU and GPU memory.
How Composite Attestation and Key Release Guard AI Workloads
The platform relies on attestation to verify the runtime environment before any data or model weights are unlocked. Fortanix is developing open-source plugins for the CoCo project that connect its Confidential Computing Manager for attestation and its Data Security Manager for key release. Under this workflow, containers are checked to confirm they are genuine, running inside a trusted execution environment, and compliant with security policy before encryption keys are released.
The Confidential Computing Manager can attest the processor and the graphics processing unit together through composite attestation, ensuring an inference job spanning both components is covered in full. If attestation fails, encryption keys remain within the Data Security Manager and are never handed over to the workload. An Intel TDX deployment guide noted that two GPU settings are available: a required setting makes the manager validate GPU evidence through NVIDIA’s attestation service, while an ignored setting checks only that evidence is present and disregards the result.
Containers are how the world ships applications, and in the AI era, they’re what makes AI scalable. But moving AI into containers doesn’t change the threat.
Anand Kashyap, Co-Founder and Chief Executive Officer at Fortanix
Kashyap added that models, agents, and applications still handle an organization’s most sensitive data during execution. The setup is designed for deployment as a hosted service, on-premises, or in fully air-gapped environments. Enterprises can utilize this framework to run a leading lab’s proprietary model alongside their own information without exposing the lab’s intellectual property to danger.
Ecosystem Support and Production Scale Commitments
The updated platform is available now, with deployment documented through the Fortanix CoCo Helm chart. Fortanix plans to demonstrate the capabilities on NVIDIA GPUs with confidential computing enabled at NVIDIA GTC Berlin, which runs Oct. 20-22. The underlying Confidential Computing Manager received CoCo application registration support for AMD Secure Encrypted Virtualization-Secure Nested Paging and Intel Trust Domain Extensions in a September 17 release.
The roster of organizations backing the initiative features NVIDIA, Intel, AMD, Microsoft, HPE, Cisco, CrowdStrike, Supermicro, Red Hat, ElevenLabs, Deepgram, Gnani, Resemble AI, Rafay, Spectro Cloud, Nutanix, Telus, Core42, L&T, MCS, the Technology Innovation Institute, CoreWeave and ClearML, as cited by Fortanix.
With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves.
Anuj Jaiswal, Chief Product Officer at Fortanix
Jaiswal emphasized that attestation is a protocol while trust is an operation, noting that the combination spares enterprises from constructing custom trust layers. John Fanelli, vice president of enterprise software at NVIDIA, noted that the collaboration builds on open standards for attestation and secure key release at production scale.
