Arca: A Lightweight Confidential Container Architecture for Cloud-Native Environments
Di Lu, Mengna Sun, Qingwen Zhang, Yujia Liu, Jia Zhang, Xuewen Dong, Yulong Shen, and Jianfeng Ma

TL;DR
Arca introduces a lightweight, TEE-in-Container architecture for cloud-native workloads that enhances security, reduces overhead, and maintains high performance by isolating each workload in independent trust domains.
Contribution
The paper proposes a novel TEE-in-Container design that isolates workloads, minimizes TCB, and improves security and performance over existing container-in-TEE solutions.
Findings
Achieves near-native performance on multiple TEE platforms.
Outperforms existing CoCo framework in benchmarks.
Significantly reduces TCB, enhancing verifiability and resilience.
Abstract
Confidential containers protect cloud-native workloads using trusted execution environments (TEEs). However, existing Container-in-TEE designs (e.g., Confidential Containers (CoCo)) encapsulate the entire runtime within the TEE, inflating the trusted computing base (TCB) and introducing redundant components and cross-layer overhead. We present Arca, a lightweight confidential container framework based on a TEE-in-Container architecture that isolates each workload in an independent, hardware-enforced trust domain while keeping orchestration logic outside the TEE. This design minimizes inter-layer dependencies, confines compromise to per-container boundaries, and restores the TEE's minimal trust principle. We implemented Arca on Intel SGX, Intel TDX, and AMD SEV. Experimental results show that Arca achieves near-native performance and outperforms CoCo in most benchmarks, while the reduced…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Cloud Computing and Resource Management · Cloud Data Security Solutions
