Limitations and gotchas
note
Not every Codesphere instance offers confidential compute. Ask your Codesphere administrator whether confidential compute is available on your instance. See Prerequisites.
Confidential services run on the same platform as regular ones, but some things behave differently. Most of the differences follow from one rule: nothing outside the TEE may see or change what happens inside.
Performance and resource overhead
- Slower startup. Each confidential service boots a micro-VM and passes attestation before the service starts. This affects first starts, restarts, scaling and waking up from off when unused.
- Memory overhead. Every micro-VM needs memory for its own guest kernel. Plan for more memory per service than with regular services.
- CPU and I/O overhead. Memory encryption, LUKS and mesh encryption add some overhead. The impact depends on your service, so measure it before you size production.
Build and runtime behavior
The prepare stage and any download at startup are not covered by attestation. Files changed after the service started are not covered either. Build complete images ahead of time, as described in Recommendations for production.
Networking
- All traffic between confidential services goes through the service mesh.
- Traffic to regular services or external endpoints leaves the trust boundary.
Feature availability
| Feature | Available in confidential mode |
|---|---|
| Cloud IDE and terminal | No |
| SSH and local IDE | No |
| Service Logs | No |
| Deployment status | Yes |
| Log browser | No |
| Request logs | No |
| Monitoring | Yes |
| Replicas and scaling | Yes |
| Off when unused | Yes |
| Custom domains | Yes |
| Private network (VPN) | No |
| Managed service backups | No |