EVERYTHING XIAOMI
Get listed

Inclavare Containers

Inclavare Containers is a free Linux container runtime for launching protected containers inside hardware-assisted Trusted Execution Environments.

Place
#15 of 31
Score
5.9

What Inclavare Containers is

Inclavare Containers is a free Linux container runtime for launching protected containers inside hardware-assisted Trusted Execution Environments. It creates hardware-enforced separation between a tenant workload and privileged cloud-provider software. Its Enclave Attestation Architecture supports remote attestation that sensitive workloads run on trusted TEE hardware. The `rune` component follows the OCI Runtime specification, with documented integration for dockerd, containerd, and pouchd. The project is cloud-platform agnostic and can run on public-cloud Kubernetes platforms. Deployment options include Occlum LibOS and WebAssembly Micro Runtime. Rats-TLS provides attested, secured communication between heterogeneous hardware TEEs. `shim-rune` handles enclave signing and management between containerd and `rune`, while `epm` manages cache pools for enclave startup. Installation covers source builds and RPM/DEB repositories. The project is Apache-2.0 licensed and identified as a CNCF sandbox project. Deployment requires TEE-capable hardware and its corresponding software stack, such as Intel SGX.

Good

  • Hardware-enforced workload isolation
  • Remote enclave attestation
  • OCI-compliant `rune` runtime
  • Kubernetes and containerd integration
  • Apache-2.0 licensed and free

Watch out

  • Requires TEE-capable hardware
  • Requires a corresponding TEE software stack
  • Installation may require source building

Who it suits

Inclavare Containers suits Linux and self-hosted teams deploying containers that need hardware TEE isolation, attestation, and Kubernetes or containerd integration.

Verdict

Inclavare Containers provides a free, open-source route to running containers in hardware-assisted TEEs. Its security architecture and cloud-platform flexibility are useful when the required hardware and software stack are available.

Plans and prices

From Inclavare Containers's own pricing page, checked 9 Oct 2026.

All about pricing
PlanPriceWhat it gives you
Inclavare ContainersFreeOpen-source container runtime · requires hardware TEE and corresponding software stack for deployment

The facts

Each one read from Inclavare Containers's own pages, with the date it was checked.

What it does

Attestation
Its Enclave Attestation Architecture provides remote attestation to show that sensitive workloads run on trusted hardware TEEs.checked 9 Oct 2026
Cloud deployment
The project says it is cloud platform agnostic and can be deployed on public-cloud Kubernetes platforms.checked 9 Oct 2026
Enclave runtimes
Documented deployment options include Occlum LibOS and WebAssembly Micro Runtime (WAMR).checked 9 Oct 2026
Hardware requirement
The documented development environment must support hardware TEE and have the corresponding software stack, such as Intel SGX, installed.checked 9 Oct 2026
Installation
The README describes building from source or installing through RPM/DEB repositories, with an Ubuntu 18.04 installation example.checked 9 Oct 2026
Integrations
The project documents integration with dockerd, containerd, and pouchd.checked 9 Oct 2026
Isolation
It creates hardware-enforced isolation between a tenant’s workload and privileged software controlled by a cloud service provider.checked 9 Oct 2026
License and project status
The repository identifies the project as Apache-2.0 licensed and a CNCF sandbox project.checked 9 Oct 2026
OCI runtime
The `rune` component is described as fully compliant with the OCI Runtime specification.checked 9 Oct 2026
Purpose
Inclavare Containers is a container runtime for launching protected containers in hardware-assisted Trusted Execution Environments (TEEs).checked 9 Oct 2026
Signing and management
The `shim-rune` component conducts enclave signing and management between containerd and `rune`.checked 9 Oct 2026
Startup optimization
The `epm` service manages cache pools to optimize enclave startup time.checked 9 Oct 2026
Trusted communication
Rats-TLS supports trusted communication between heterogeneous hardware TEEs using an attested, secured channel.checked 9 Oct 2026

Alternatives to Inclavare Containers

All alternatives
  1. 1LXD logo

    LXD

    Free planWebAPILinuxSelf-hosted
    7.0From $25 a year
    Visit
  2. 2

    BuildKit

    Free planAPILinuxmacOSSelf-hosted
    6.8Free plan
    Visit
  3. 3

    Incus

    Free planAPILinuxmacOSSelf-hosted
    6.8Free plan
    Visit
  4. 4

    Apptainer

    Free planAPILinuxmacOSSelf-hosted
    6.7Free plan
    Visit
  5. 5

    crun

    Free planLinuxSelf-hosted
    6.5Free plan
    Visit
  6. 6Buildah logo

    Buildah

    Free planAPILinuxSelf-hosted
    6.4Free plan
    Visit