Skip to content
SPECIFICTION
Get listed

Inclavare Containers

github.com

Free plan LinuxSelf-hosted
Visit github.com
Spec score 7.7 #14 of 34 in Desktop Wallpaper Software

What it is

Inclavare Containers is a free, open-source Linux container runtime for launching protected containers in hardware-assisted Trusted Execution Environments. It creates hardware-enforced isolation between a tenant workload and privileged cloud-provider software. Its Enclave Attestation Architecture provides remote attestation that sensitive workloads run on trusted TEE hardware. The rune component is described as compliant with the OCI Runtime specification, while documented integrations include dockerd, containerd, and pouchd. Deployment can use Occlum LibOS or WebAssembly Micro Runtime, and Rats-TLS provides an attested secured channel between heterogeneous TEEs. shim-rune handles enclave signing and management between containerd and rune; epm manages cache pools for enclave startup. The project is cloud-platform agnostic and can run on public-cloud Kubernetes platforms. It supports Kubernetes CRI, uses the OCI image format, and documents Linux hosts including Ubuntu 18.04 and Alibaba Linux 2. Installation is described through source builds or RPM/DEB repositories.

Spec sheet

Purpose
Inclavare Containers is a container runtime for launching protected containers in hardware-assisted Trusted Execution Environments (TEEs).Read 9 Oct 2026 · github.com
Integrations
The project documents integration with dockerd, containerd, and pouchd.Read 9 Oct 2026 · github.com
Attestation
Its Enclave Attestation Architecture provides remote attestation to show that sensitive workloads run on trusted hardware TEEs.Read 9 Oct 2026 · github.com
Cloud deployment
The project says it is cloud platform agnostic and can be deployed on public-cloud Kubernetes platforms.Read 9 Oct 2026 · github.com
Enclave runtimes
Documented deployment options include Occlum LibOS and WebAssembly Micro Runtime (WAMR).Read 9 Oct 2026 · github.com
Hardware requirement
The documented development environment must support hardware TEE and have the corresponding software stack, such as Intel SGX, installed.Read 9 Oct 2026 · github.com
Installation
The README describes building from source or installing through RPM/DEB repositories, with an Ubuntu 18.04 installation example.Read 9 Oct 2026 · github.com
Isolation
It creates hardware-enforced isolation between a tenant’s workload and privileged software controlled by a cloud service provider.Read 9 Oct 2026 · github.com
License and project status
The repository identifies the project as Apache-2.0 licensed and a CNCF sandbox project.Read 9 Oct 2026 · github.com
OCI runtime
The `rune` component is described as fully compliant with the OCI Runtime specification.Read 9 Oct 2026 · github.com
Signing and management
The `shim-rune` component conducts enclave signing and management between containerd and `rune`.Read 9 Oct 2026 · github.com
Startup optimization
The `epm` service manages cache pools to optimize enclave startup time.Read 9 Oct 2026 · github.com
Trusted communication
Rats-TLS supports trusted communication between heterogeneous hardware TEEs using an attested, secured channel.Read 9 Oct 2026 · github.com

Plans and prices

Inclavare Containers Free Open-source container runtime · requires hardware TEE and corresponding software stack for deployment Read 9 Oct 2026 · github.com

Every Inclavare Containers plan and price →

Strong points and limits

Strong points

  • Hardware-enforced workload isolation
  • Remote attestation for trusted TEEs
  • OCI-compliant rune runtime
  • Public-cloud Kubernetes deployment
  • Apache-2.0 licensed and free

Limits

  • Requires hardware TEE support
  • Requires a corresponding TEE software stack
  • Linux deployment only
  • Installation may require building from source

Who it suits

Inclavare Containers suits Linux and Kubernetes users who need hardware-backed workload isolation and remote attestation. It requires hardware supporting a TEE and the corresponding software stack, such as Intel SGX.

Verdict

Inclavare Containers focuses on confidential container execution with attestation and hardware isolation. Its free license and Kubernetes integrations are useful, provided your Linux environment has the required TEE hardware and software.

Where Specifiction places it

Alternatives to Inclavare ContainersAll alternatives →