Confidential computing and attestation
Planned — next. Tested once, on 2026-10-14: a test image built from x0ne OS ran as an Intel TDX guest with an NVIDIA H100 in confidential mode on Google Cloud, and the attestation was verified end to end. No confidential image is published yet.
Check what runs before you send it anything. A confidential VM proves its code against a reference you pin, then receives your prompt.
What x0ne OS brings
- Guest: x0ne OS runs as an Intel TDX guest; AMD SEV-SNP is planned. Memory is encrypted from the host.
- GPU: NVIDIA Hopper in confidential computing mode, attested in the same session as the CPU, bound to it by a shared nonce, not by the hardware. Blackwell is planned.
- Measured boot: kernel, initrd and command line in one signed image (UKI), root filesystem verified by dm-verity.
- Published measurements: each release publishes its launch measurements, beside
SHA256SUMS.
The confidential flavour is the qcow2 VM only. Not the microVM, not the container.
The attestation flow
client confidential VM (x0ne OS) | 1. nonce ------------------------> | | | 2. CPU report (SNP or TDX) | <--------- report + GPU report | + GPU report | 3. compare with the measurements | | published for this release | | 4. match? send prompt or model key ->| | no match? send nothing |
A key broker can hold the model key and release it only after step 3. Planned
With x0ne Engine
x0ne Engine serves inference only inside a verified trusted execution environment. x0ne OS gives it published reference measurements, and the key broker once built. See x0ne Engine.
How to verify, once shipped
- Rebuild the image from source.
- Compute its launch measurement.
- Compare with the published value. They must match.
Intel TDX comes first: it is the one tested on hardware. AMD SEV-SNP follows after the first release.
How to undo
A confidential VM is a fresh VM. Stop it and delete its disk; its memory goes with it. The host still keeps what it saw: the VM's metadata, times, sizes, IP addresses and the bill.