Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866915706980794368 |
|---|---|
| author | Lu, Di Sun, Mengna Zhang, Qingwen Liu, Yujia Zhang, Jia Dong, Xuewen Shen, Yulong Ma, Jianfeng |
| author_facet | Lu, Di Sun, Mengna Zhang, Qingwen Liu, Yujia Zhang, Jia Dong, Xuewen Shen, Yulong Ma, Jianfeng |
| contents | Confidential containers protect cloud-native workloads using trusted execution environments (TEEs). However, existing Container-in-TEE designs (e.g., Confidential Containers (CoCo)) encapsulate the entire runtime within the TEE, inflating the trusted computing base (TCB) and introducing redundant components and cross-layer overhead. We present Arca, a lightweight confidential container framework based on a TEE-in-Container architecture that isolates each workload in an independent, hardware-enforced trust domain while keeping orchestration logic outside the TEE. This design minimizes inter-layer dependencies, confines compromise to per-container boundaries, and restores the TEE's minimal trust principle. We implemented Arca on Intel SGX, Intel TDX, and AMD SEV. Experimental results show that Arca achieves near-native performance and outperforms CoCo in most benchmarks, while the reduced TCB significantly improves verifiability and resilience against host-level compromise. Arca emonstrates that efficient container management and strong runtime confidentiality can be achieved without sacrificing security assurance. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_01214 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments Lu, Di Sun, Mengna Zhang, Qingwen Liu, Yujia Zhang, Jia Dong, Xuewen Shen, Yulong Ma, Jianfeng Cryptography and Security Confidential containers protect cloud-native workloads using trusted execution environments (TEEs). However, existing Container-in-TEE designs (e.g., Confidential Containers (CoCo)) encapsulate the entire runtime within the TEE, inflating the trusted computing base (TCB) and introducing redundant components and cross-layer overhead. We present Arca, a lightweight confidential container framework based on a TEE-in-Container architecture that isolates each workload in an independent, hardware-enforced trust domain while keeping orchestration logic outside the TEE. This design minimizes inter-layer dependencies, confines compromise to per-container boundaries, and restores the TEE's minimal trust principle. We implemented Arca on Intel SGX, Intel TDX, and AMD SEV. Experimental results show that Arca achieves near-native performance and outperforms CoCo in most benchmarks, while the reduced TCB significantly improves verifiability and resilience against host-level compromise. Arca emonstrates that efficient container management and strong runtime confidentiality can be achieved without sacrificing security assurance. |
| title | Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2601.01214 |