Confidential VMs enable cloud service providers to operate a secure and trustworthy multi-tenant cloud infrastructure. The confidential computing architecture enforces strong isolation for mutually untrusted tenants, i.e., guest VMs, and protects tenants against an untrusted hypervisor. While confidential VMs ensure comprehensive protection for cloud workloads, such heavy-weight isolation is often omitted for serverless applications that co-locate thousands of cloud workers within the same process to optimize FaaS overheads through efficient context switches.

Trusted Execution Environments (TEEs) and enclaves have become increasingly popular and are used from embedded devices to cloud servers. Today, many enclave architectures exist for different ISAs. However, some suffer from performance issues and controlled-channel attacks, while others only support constrained use cases for embedded devices or impose unrealistic constraints on the software. Modern cloud applications require a more flexible architecture that is both secure against such attacks and not constrained by, e.g., a limited number of physical memory ranges.