Supported Platforms#

Following are the platforms supported by the NVIDIA Confidential Containers Reference Architecture.

This page is relevant to the following users:

Hardware#

NVIDIA GPUs#

GPU

Passthrough

NVIDIA H100

Single-GPU

NVIDIA H200

Single-GPU

NVIDIA H100 Protected PCIe (PPCIe)

Multi-GPU

NVIDIA H200 Protected PCIe (PPCIe)

Multi-GPU

NVIDIA B200

Single-GPU, Multi-GPU

NVIDIA HGX B300

Single-GPU, Multi-GPU

NVIDIA RTX Pro 6000 BSE

Single-GPU

Note

Multi-GPU passthrough on NVIDIA Hopper HGX systems requires that you set the Confidential Computing mode to ppcie mode. Refer to Managing the Confidential Computing Mode for details.

Note

For both single and multi GPU Passthrough, all GPUs on the host must be configured for Confidential Computing and all GPUs must be assigned to one Confidential Container virtual machine. Configuring only some GPUs on a node for Confidential Computing is not supported.

Host Platforms#

CPU Platform

TEE

Host Operating System

Host Kernel Version

AMD Genoa / Milan

AMD SEV-SNP

Ubuntu 25.10 or 26.04

6.17+

Intel Emerald Rapids (ER) / Granite Rapids (GR)

Intel TDX

Ubuntu 25.10 or 26.04

6.17+

For additional information on node configuration, refer to the Confidential Computing Deployment Guide for information about supported NVIDIA GPUs, such as the NVIDIA Hopper H100.

The following topics in the deployment guide apply to a cloud-native environment:

  • Hardware selection and initial hardware configuration, such as BIOS settings.

  • Host operating system selection, initial configuration, and validation.

When following the cloud-native sections in the deployment guide linked above, use Ubuntu 25.10 or 26.04 as the host OS with its default kernel version and configuration.

For additional resources on machine setup:

Supported Software Components#

Cluster and Deployment Software#

The installation guides begin with an existing Kubernetes cluster that uses containerd. You then install Kata Containers and the NVIDIA GPU Operator.

Component

Release/Version

Installation

Kubernetes

1.32 +

Prerequisite, must already be installed on the cluster hosts.

containerd

2.3.x

Prerequisite, must already be installed on the cluster hosts.

Kata Containers

4.0.0

Installed with the kata-deploy Helm chart by following the Quickstart Install or Detailed Install Guide.

NVIDIA GPU Operator and its components.

Refer to the GPU Operator Component Matrix for the list of components and versions included in each release.

v26.3.1 and higher

Installed by following the Quickstart Install or Detailed Install Guide.

Kata-provided Guest and Runtime Artifacts#

The supported kata-deploy Helm chart installs the guest OS, guest kernel, OVMF, and QEMU artifacts listed in the following table as part of Kata Containers. You do not supply or install these artifacts individually.

Artifact

Release/Version

Guest OS

Distroless

Guest kernel

6.18.5

OVMF

edk2-stable202511

QEMU

10.1 + Patches

Separately Deployed Components and Interfaces#

The following components and interfaces are not installed by the Quickstart Install or Detailed Install Guide.

Interface or Component

Version

When It Is Needed

How It Is Provided

Key Broker Service (KBS) protocol

0.4.0

Required for Trustee-based attestation and secret or key release.

The Attestation quickstart installs a local evaluation Trustee. Deploy a production Trustee separately by following the upstream Confidential Containers documentation.

Kata Lifecycle Manager

0.1.8

Optional for Kata Containers upgrades and day-two lifecycle management.

Install separately by following the upstream Kata Lifecycle Manager documentation.

Kata Containers genpolicy

4.0.0

Used to generate an agent security policy for attested production workloads.

Download separately from the corresponding Kata Containers release.

Users may leverage Red Hat OpenShift Sandboxed Containers to deploy Confidential Containers.