Fortanix has announced that its Fortanix Confidential AI platform now supports Confidential Containers (CoCo), the Cloud Native Computing Foundation (CNCF) project for running Kubernetes containers inside hardware-protected execution environments. The Santa Clara, California-based company announced it on October 18, 2026, and will demo it live at NVIDIA GTC Berlin, running October 20-22. The goal is to let AI workloads on Kubernetes process sensitive data and models without the infrastructure provider being able to see them.
Fortanix Confidential AI on Kubernetes in 20 seconds
- Fortanix integrates its platform with CoCo, the CNCF’s confidential containers project.
- It’s building open-source plugins that verify each container before handing it keys.
- Keys are stored in its HSM, certified to FIPS 140-2 Level 3.
- It runs as SaaS, on-premises, or in air-gapped environments.
The announcement lands at a time when many companies want to use AI with data that can’t leave their control, such as medical records, financial information, or intellectual property. Confidential computing encrypts data while it’s being processed too, not just when it’s stored or transmitted, and that’s the gap Fortanix wants to close in Kubernetes.
How confidential containers work
CoCo runs each Kubernetes pod inside a confidential virtual machine, relying on Kata Containers and the Trusted Execution Environments (TEEs) that modern processors provide. Those environments isolate the container’s memory from the host system, the hypervisor, and the platform’s administrators. Before a container receives secrets, such as the keys to decrypt an image or a model, it must pass remote attestation: cryptographic proof that it’s running on genuine hardware with the expected software.
What Fortanix is adding are open-source plugins, still under development according to the company itself, that connect that standard CoCo flow to two of its own products. Fortanix Confidential Computing Manager handles attestation, and Fortanix Data Security Manager, its key management system and hardware security module (HSM), only hands out keys when attestation succeeds and only inside the protected environment. According to Fortanix, verification is composite: it checks both the CPU and the GPU before any sensitive workload runs.
Fortanix’s chief product officer, Anuj Jaiswal, summed up the idea in the announcement by saying that attestation is a process and trust is an operation. Its CEO, Anand Kashyap, argues that containers are how applications get deployed and what makes it possible to scale AI.
Supported hardware and enterprise features
The announcement doesn’t spell out a closed list of hardware, but it includes statements from the major chipmakers. Intel cites its TDX technology, which isolates models and data in use at the hardware level; AMD points to its EPYC processors and Instinct accelerators; and NVIDIA refers to its GPU confidential computing, which, according to John Fanelli, the company’s vice president of enterprise software, keeps both data and models private. The Berlin demo will run on compatible NVIDIA GPUs.
For production environments, Fortanix highlights high-availability cluster deployment, so key delivery isn’t a single point of failure, 24×7 global support with a service-level agreement, and FIPS 140-2 Level 3, SOC 2 Type 2, and ISO/IEC 27001 certifications. The platform can be used as a cloud service, deployed on-premises, or in environments fully isolated from the internet. The company says it’s available now, though it doesn’t clarify whether the open-source CoCo plugins are finished or still in testing.
Fortanix lists 23 ecosystem partners, including NVIDIA, AMD, Intel, Red Hat, Dell Technologies, HPE, Supermicro, Cisco, and CrowdStrike, without detailing each one’s role in this integration. It isn’t the first alliance of this kind: Revista Cloud already reported how Fortanix partnered with HPE and NVIDIA to secure AI factories with confidential computing.
Frequently asked questions
What is Confidential Containers (CoCo)?
It’s a CNCF project that runs Kubernetes pods inside hardware-protected confidential virtual machines, so that neither the host nor the infrastructure provider can see the data in use.
What does Fortanix add to CoCo?
It’s developing open-source plugins that connect CoCo to its attestation manager and key system, which only hand out keys to verified containers.
What hardware does it work with?
The announcement mentions Intel TDX, AMD EPYC processors and Instinct accelerators, and NVIDIA GPU confidential computing, without publishing a closed list.
How can it be deployed?
As a cloud service, on-premises, or in environments isolated from the internet, according to Fortanix.
Sources:
