With the release of OpenStack 2026.2 “Hibiscus”, we’re happy to share that CanaryBit has contributed to Confidential Computing support in OpenStack, enabling hardware-isolated virtual machines built on technologies for Intel® Trust Domain Extensions (TDX) along side AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP).
The last gap in data protection
Most organizations already encrypt data at rest and in transit. But data has to be decrypted to be processed, and while it is in use in memory, it is exposed to the host operating system, the hypervisor, and anyone with privileged access to the infrastructure.
Confidential computing closes that gap by protecting data in use through hardware-enforced isolation.
How confidential VMs work
Modern server CPUs can now run virtual machines in a protected mode where the hardware, not the hypervisor, enforces isolation:
- Intel TDX creates hardware-isolated virtual machines called Trust Domains.
- AMD SEV-SNP encrypts guest memory and adds integrity protection against hypervisor-level tampering, such as memory remapping and replay attacks.
Despite their differences, the technologies share the same core properties:
- Memory encryption: guest memory is encrypted by the CPU, with keys the host cannot access.
- Integrity protection: the hypervisor cannot silently modify or replay a guest’s memory.
- Remote attestation: workload owners can cryptographically verify that their VM runs on genuine hardware with the expected firmware and software before releasing secrets to it.
What we contributed
Our team worked with the OpenStack community to make confidential instances easier to schedule, launch, and manage Intel TDX based Confidential VMs in Hibiscus.
Detailed information about out work can be found here: https://specs.openstack.org/openstack/nova-specs/specs/2026.2/implemented/intel-tdx-libvirt-support.html
Why it matters
For cloud operators: Offer a differentiated confidential VM service on your private or public cloud, on the hardware platform of your choice, without moving to a proprietary stack.
For enterprises and regulated industries: Host sensitive workloads in finance, healthcare, government, and other regulated sectors with much stronger guarantees. This supports compliance and data sovereignty requirements.
For the wider community: OpenStack gains a hardware-agnostic foundation for confidential computing that can keep evolving alongside the silicon ecosystem.
Use cases
- Protecting sensitive data such as personal, financial, or health information during processing
- Securing AI and ML workloads, including proprietary models and training data
- Multi-party analytics, where organizations collaborate on data without exposing it to each other or to the infrastructure operator
- Sovereign and regulated cloud environments that need verifiable trust in the underlying platform
Getting started
To run confidential workloads on OpenStack Hibiscus, you’ll need:
- Supported hardware: a server with a processor that supports Intel TDX or AMD SEV-SNP, with the required firmware and BIOS settings enabled
- A supported host stack: a host OS with Linux Kernel 6.16, QEMU 10.1 and Libvirt 11.6 version for both AMD SEV-SNP and Intel TDX support
- OpenStack Hibiscus configured to schedule and launch confidential instances
- A compatible guest image with confidential computing support, e.g. Ubuntu 26.04
For more information follow the official OpenStack 2026.2 “Hibiscus” documentation.
Special Thanks
This work was only possible thanks to the OpenStack community’s reviewers and maintainers, our hardware and ecosystem partners, and the engineers at CanaryBit who drove it from design to release.
We’re committed to open infrastructure and to making secure-by-design cloud and confidential computing available to everyone. We welcome your feedback, bug reports, and ideas for what comes next.
Following our work on Proxmox VE 8.4, this is the second major contribution by CanaryBit to the open-source community in support of Confidential Computing.
