Open Source Summit Japan 2022

With continual security requirements of tenants while deploying containers in public cloud, cloud service providers leverage hardware based TEE techniques (Intel's SGX/TDX, AMD's SEV) to launch tenants' containers. Definitely, such solution is meaningful and can win the trust from the tenants, which is led by "Confidential Containers" sandbox project. Unfortunately, there will be some performance drop while using such technology. And container tenants may still want to have acceptable performance while using such technique. In this talk, we would like to address the bootup of containers which are using overlay format while they are running in TEE environment but still satisfy the security requirements. Generally, we have the following contributions: (1)Accelerating the image downloads with overlayed format and reducing the key negotiation overhead with KMS. Instead of downloading the single layer and negotiate the KMS to get the image layer decrypt key. We design the method to get all the keys by one round while negotiating with the KMS instead of multiple rounds; (2) We can leverage some accelerating techniques to offload the image decryption efforts done by CPU.