- Home
- Container Engines
- Inclavare Containers
Inclavare Containers
What it is
Inclavare Containers is a free Linux container runtime for launching protected containers in hardware-assisted Trusted Execution Environments. It creates hardware-enforced isolation between a tenant workload and privileged cloud-provider software, while its Enclave Attestation Architecture provides remote attestation for trusted hardware. The rune component complies with the OCI Runtime specification and integrates with dockerd, containerd, and pouchd. The project documents Occlum LibOS and WebAssembly Micro Runtime deployment options. Rats-TLS supports attested communication between heterogeneous TEEs; shim-rune handles enclave signing and management; and epm manages cache pools for startup optimization. Inclavare Containers is described as cloud-platform agnostic and deployable on public-cloud Kubernetes platforms. Installation is available through source builds or RPM/DEB repositories. It is Apache-2.0 licensed and identified as a CNCF sandbox project. Deployment requires hardware TEE support and the corresponding software stack, such as Intel SGX.
For and against
For
- Hardware-enforced workload isolation
- Remote attestation for trusted hardware
- OCI-compliant runtime component
- Cloud-platform agnostic deployment
- Apache-2.0 licensed project
Against
- Requires hardware TEE support
- Requires corresponding TEE software stack
- Linux and self-hosted deployment
- Installation may require source building
The verdict
Inclavare Containers focuses on confidential container workloads with attestation and TEE isolation. Its free license is useful, but hardware and platform requirements are central to deployment.
Who it suits
It suits Linux and Kubernetes operators who need protected containers and remote attestation. A compatible hardware TEE and software stack are required.
Plans and prices
Inclavare Containers
Open-source container runtime · requires hardware TEE and corresponding software stack for deployment
Read 9 Oct 2026 · github.com
On the record
- Attestation
- Its Enclave Attestation Architecture provides remote attestation to show that sensitive workloads run on trusted hardware TEEs.github.com · read 9 Oct 2026
- Cloud deployment
- The project says it is cloud platform agnostic and can be deployed on public-cloud Kubernetes platforms.github.com · read 9 Oct 2026
- Enclave runtimes
- Documented deployment options include Occlum LibOS and WebAssembly Micro Runtime (WAMR).github.com · read 9 Oct 2026
- Hardware requirement
- The documented development environment must support hardware TEE and have the corresponding software stack, such as Intel SGX, installed.github.com · read 9 Oct 2026
- Installation
- The README describes building from source or installing through RPM/DEB repositories, with an Ubuntu 18.04 installation example.github.com · read 9 Oct 2026
- Integrations
- The project documents integration with dockerd, containerd, and pouchd.github.com · read 9 Oct 2026
- Isolation
- It creates hardware-enforced isolation between a tenant’s workload and privileged software controlled by a cloud service provider.github.com · read 9 Oct 2026
- License and project status
- The repository identifies the project as Apache-2.0 licensed and a CNCF sandbox project.github.com · read 9 Oct 2026
- OCI runtime
- The `rune` component is described as fully compliant with the OCI Runtime specification.github.com · read 9 Oct 2026
- Purpose
- Inclavare Containers is a container runtime for launching protected containers in hardware-assisted Trusted Execution Environments (TEEs).github.com · read 9 Oct 2026
- Signing and management
- The `shim-rune` component conducts enclave signing and management between containerd and `rune`.github.com · read 9 Oct 2026
- Startup optimization
- The `epm` service manages cache pools to optimize enclave startup time.github.com · read 9 Oct 2026
- Trusted communication
- Rats-TLS supports trusted communication between heterogeneous hardware TEEs using an attested, secured channel.github.com · read 9 Oct 2026
