Skip to content
Docs

Confidential Computing

Confidential computing protects model weights and prompts while they are being processed, by running inside a confidential virtual machine with the GPU in confidential mode.

It is a licensed capability, not a configuration flag: requesting it without the entitlement leaves it dormant and reports why.

The three modes

Section titled “The three modes”
Mode Behaviour
off Disabled.
auto (default) Detects, attests and reports, but never blocks a server from starting. Safe to leave on everywhere.
require Refuses to start a server on a host that does not attest.

Both halves are required

Section titled “Both halves are required”

CPU: Intel Xeon with TDX, or AMD EPYC with SEV-SNP — and the workload must run inside the confidential VM.

GPU: NVIDIA H100, H200, B100/B200, GB200/GB300, or RTX PRO 6000 Blackwell Server Edition, in confidential mode.

Not sufficient — the list people get wrong

Section titled “Not sufficient — the list people get wrong”
  • Desktop or workstation CPUs (Core i9, Ryzen). Neither technology.
  • Intel TME. It appears in lscpu and looks like the right thing. It is not TDX and provides no trusted execution environment. This is the most common false positive.
  • Bare metal instead of a confidential VM. The CPU may support it, but with nothing attesting there is no guarantee.
  • RTX PRO 6000 Blackwell Workstation or Max-Q, as against the Server edition. “Blackwell” alone is not sufficient.
  • AMD GPUs, at all. An EPYC SEV-SNP host satisfies only the CPU half.

States

Section titled “States”

The License page reports which half is missing rather than a bare failure. A state other than attested is correct behaviour on hardware that cannot attest — it is not a fault to chase.

On an AMD GPU host the feature reports a distinct unsupported-accelerator state, checked before the licensing gate, so nobody is sent off to buy an add-on that cannot work on their hardware.

Why require is safe on AMD

Section titled “Why require is safe on AMD”

require normally refuses every server start on a non-attesting host — which is the point of the mode: on NVIDIA, a non-attesting host is usually a misconfiguration (the GPU is not in confidential mode, the VM was not launched as confidential), and refusing is exactly right.

On AMD it is not a misconfiguration but an impossibility, so Lifeboat downgrades the mode to off, logs the reason once, and lets servers start. A host that can never attest, refusing forever, would look like Lifeboat being broken.

Attestation cadence

Section titled “Attestation cadence”

Attestation is re-checked periodically, because it lapses on a GPU reset or a live migration of the confidential VM. It is not established once and trusted forever.

Entitlement

Section titled “Entitlement”

Confidential computing requires an entitled licence. On an online licence an entitlement upgrade reaches a running deployment on its next check-in — no new key, no restart. An offline deployment needs a re-issued licence file.

Sources and references

Section titled “Sources and references”