AKS confidential containers for model isolation

Problem

Some AI workloads need runtime confidentiality: protect model artifacts and user data from the host OS/kernel and operators. AKS confidential containers (kata-cc) isolate the pod in a confidential utility VM with attestation and policy controls. Trade-offs include startup time, debugging limitations, and preview status constraints.

Options and trade-offs

• AKS confidential VM node pool: Node-level boundary; simpler lift-and-shift; not per-pod sandbox.
• AKS confidential containers (kata-cc): Pod-level confidential sandbox, policy generator and attestation; more operational constraints; supports Azure Linux and specific VM SKUs; preview limitations apply.
• ACI confidential containers: Container group boundary; suitable for event-driven jobs; fewer orchestration features than AKS.

Minimal working example

Prereqs

• Azure CLI 2.44.1+; aks-preview and confcom extensions; Azure Linux; KataCcIsolation on node pool; enable workload identity and OIDC issuer if key release requires identity linkage.

Create cluster (example)

az aks create --resource-group rg --name aks-cc \
  --kubernetes-version 1.25.0 \
  --os-sku AzureLinux \
  --node-vm-size Standard_DC8as_cc_v5 \
  --workload-runtime KataCcIsolation \
  --enable-oidc-issuer --enable-workload-identity

Deploy consumer with attestation sidecar and policy Generate policy with confcom; apply as annotation; tie Key Vault key release to attestation measurement. Test: Remove kata-cc spec and policy; confirm ciphertext (no key release).

Checklist

• Confirm supported SKUs and OS; Azure Linux only for kata-cc at present.
• Enable and maintain policy (do not use :latest tags because layers are measured).
• Expect longer pod startup and limited troubleshooting (exec/stdio require policy change).
• Integrate attestation with Key Vault for secure key release.

Where this doesn't apply

Windows node pools; or workloads requiring frequent interactive debugging incompatible with kata-cc constraints.

Sources

• Confidential containers (Preview) — https://learn.microsoft.com/en-us/azure/aks/confidential-containers-overview (accessed 2026-10-13).
• Deploy AKS with confidential containers policy — https://learn.microsoft.com/en-us/azure/aks/deploy-confidential-containers-default-policy (accessed 2026-10-13).
• Confidential containers overview (Azure confidential computing) — https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/confidential-computing/confidential-containers.md (accessed 2026-10-13).

---