Description

libkrun-sev allows running confidential workloads in a lightweight VM within a container. I'd like to experiment with libkrun-sev, the oci2cw image tool, and attestation using reference-kbs.

Goals

Start a container with confidential workload on an LUKS encrypted disk. Attest the container against a reference KBS, which on success provides a key to unlock the disk and start running the workload.

Resources