Fortanix adds CNCF Confidential Containers support

Fortanix has added support for CNCF Confidential Containers to its Confidential AI platform, allowing organisations to run AI workloads on Kubernetes inside trusted execution environments on confidential CPUs and GPUs.

The update is aimed at businesses that want to use containerised AI while protecting data, models, agents and applications during processing. It is targeting sectors that handle sensitive or sovereign information, including financial services, healthcare, pharmaceuticals and government.

The support extends the open-source Confidential Containers project, also known as CoCo, into production deployments where enterprises need attestation, key management and audit controls. The platform verifies hardware and workloads before releasing encryption keys, with the checks carried out inside trusted execution environments.

Fortanix is also developing open-source plugins for CoCo that connect Fortanix Confidential Computing Manager for attestation and Fortanix Data Security Manager for key release. According to the company, the plugins fit into CoCo's standard workflows to verify that each container is genuine, running inside a trusted execution environment and meets policy requirements before keys are released.

The approach addresses a gap that remains when AI systems rely on conventional encryption alone. Data may be protected when stored or moved across networks, but during inference, model weights and sensitive information are typically decrypted in CPU or GPU memory.

Fortanix said its system verifies both the underlying hardware and the AI workload before any sensitive task begins. It added that CPUs and GPUs are checked together through what it described as composite attestation, validating the full execution path rather than only one part.

The release has backing from a broad group of technology companies and AI firms tied to the Confidential Containers ecosystem. Those named by Fortanix include NVIDIA, Intel, AMD, Microsoft, HPE, Cisco, CrowdStrike, Supermicro, Red Hat, ElevenLabs, Deepgram, Gnani, Resemble AI, Rafay, Spectro Cloud, Nutanix, Telus, Core42, L&T, MCS, Technology Innovation Institute, CoreWeave, ClearML, Alpha Compute, Fujitsu, Klique, Personal AI and VAST Data.

Organisations can deploy the product as software as a service, on-premises or in fully air-gapped environments, making it suitable for regulated and disconnected settings where cloud dependency is not acceptable.

Fortanix also pointed to survey data it commissioned with Atomik Research on enterprise AI deployment. According to the company, 93% of AI leaders understand that traditional encryption does not protect data while it is being processed by AI, but only half can fully verify that such protection is in place during inference.

In production environments, the platform is designed to avoid turning key release into a single point of failure through clustered deployment. Fortanix also highlighted certifications including FIPS 140-2 Level 3, SOC 2 Type 2 and ISO/IEC 27001, and said the software is already used by governments, banks, healthcare providers, technology companies, retailers and cybersecurity groups.

"Containers are how the world ships applications, and in the AI era, they're what makes AI scalable. But moving AI into containers doesn't change the threat," said Anand Kashyap, Co-Founder and Chief Executive Officer, Fortanix. "Models, agents and applications still touch an organization's most sensitive data and intellectual property, and each one needs zero-trust security, including while it runs. That's why we built Fortanix Confidential AI support for Confidential Containers: so teams can deploy containers into confidential computing environments with one click across supported hardware and Kubernetes platforms, with every workload verified before a single key is released."

Fortanix framed the launch as an effort to turn open-source confidential computing work into systems that can meet internal governance and external audit requirements. It said the trust layer is a key issue for enterprises moving AI tools from testing to operational use.

"Attestation is a protocol. Trust is an operation," said Anuj Jaiswal, Chief Product Officer, Fortanix. "CoCo has proven that confidential AI works in open source. Enterprises now need it to run reliably in production. Fortanix Confidential AI protects both the model owner's intellectual property and the enterprise data, and neither is exposed to the other or to the infrastructure provider. With attestation and key management in one platform, teams can adopt standard CoCo without building the trust layer themselves."

NVIDIA linked the announcement to the need to protect both enterprise data and model assets during AI processing.

"Enterprises need data to stay protected while running models and agents, and labs need the same privacy to protect their models - NVIDIA Confidential Computing keeps both data and models private," said John Fanelli, Vice President, Enterprise Software, NVIDIA. "Through open source collaboration with the CNCF Confidential Containers community, Fortanix is building on open standards for attestation and secure key release at production scale."