Inclavare Containers

What Inclavare Containers is

Inclavare Containers is a Linux container runtime for launching protected containers inside hardware-assisted Trusted Execution Environments (TEEs). It creates hardware-enforced isolation between a tenant’s workload and privileged software controlled by a cloud service provider. Its Enclave Attestation Architecture provides remote attestation to demonstrate that sensitive workloads are running on trusted TEE hardware.

The `rune` component implements the OCI Runtime specification, and the project documents Kubernetes CRI support and integrations with dockerd, containerd, and pouchd. Deployment options include Occlum LibOS and WebAssembly Micro Runtime (WAMR). Rats-TLS enables trusted communication between different hardware TEEs through an attested, secured channel. Between containerd and `rune`, `shim-rune` handles enclave signing and management; the `epm` service manages cache pools to help optimize enclave startup time.

The project describes itself as cloud-platform agnostic and deployable on public-cloud Kubernetes platforms. It is self-hosted, Linux-based, Apache-2.0 licensed, and identified as a CNCF sandbox project. Inclavare Containers is free: the listed plan is free. Deployment requires hardware that supports a TEE and its associated software stack, such as Intel SGX. The README describes building from source or installing through RPM or DEB repositories, with an Ubuntu 18.04 example.

Who it suits

Inclavare Containers suits teams deploying containerized workloads that need hardware-enforced isolation and remote attestation in TEEs. It is aimed at Linux and Kubernetes environments with compatible TEE hardware and software stacks.

Limits

The plan is free, but deployment requires hardware supporting a TEE and its corresponding software stack, such as Intel SGX.

Getting started

1. Open the project website on GitHub.
2. Check that the development environment supports hardware TEE and has the corresponding software stack installed.
3. Build Inclavare Containers from source or install it through an RPM or DEB repository.
4. For Ubuntu 18.04, follow the installation example in the README.
5. Choose a documented enclave runtime option, such as Occlum LibOS or WAMR.

Verdict

Choose Inclavare Containers if your Linux deployment needs protected containers, hardware-backed isolation, and remote attestation. Its free, Apache-2.0-licensed model may suit teams able to provide the required TEE hardware and software stack. Look elsewhere if you need a runtime that does not depend on that infrastructure.