Skip to main content
Version: Weekly Build

Prerequisites

Confidential compute is not part of every Codesphere setup. This page lists what has to be in place before you can run confidential services, and which limits apply to them.

Confidential compute availability​

Confidential compute is an additional module. It is booked when you set up your engagement with Codesphere. Codesphere runs as multiple instances, and only instances with this module can run confidential services.

Confidential services need CPUs that provide trusted execution environments (TEEs), such as AMD SEV-SNP or Intel TDX. The Codesphere instance has to run on one of the following:

  • Bare metal with recent CPUs that support these features
  • A cloud provider whose infrastructure offers confidential VMs

The hardware underneath can differ between instances. Your Codesphere administrator can tell you which hardware your instance uses, and if the confidential compute module is active in your Codesphere instance.

Trustee service​

Every confidential service passes attestation before it starts. This needs a trustee service that:

  • Runs outside the Codesphere instance that hosts your confidential services
  • Is reachable from the Codesphere instance over TLS
  • Allows the measurements of the Codesphere guest images your instance runs

Learn more at The trustee service

Services without the shared network file system​

Confidential services do not mount the workspace's shared NFS. Its contents are not part of attestation and could be changed by the operator. Your services must run from images that contain everything they need. Use custom base images, or export your workspace with the static build feature.

Limitations​

Some features are not available in confidential mode, and confidential services need more resources than regular ones. Check Limitations and gotchas before you plan a confidential setup.