Linux Security Summit Europe 2026

Confidential Computing secures an important attack vector for sensitive workloads: a provider cannot inspect or manipulate a confidential computing workload via its main memory or CPU registers. One of the key challenges of Confidential Computing is to turn a confidential virtual machine (cVM) started from a generic boot image provided by an ISV or Linux distributor into a tenant specific cVM. That is a cVM that contains tenant secrets that on the one hand side restrict unauthorized access to the cVM and on the other hand allows the cVM to identify itself towards the tenant. This presentation shows how this goal can be achieved with retrievable secrets a new technology of IBM Secure Execution for Linux (SEL) that allows to insert secrets as hardware backed keys into to a running SEL guest. These hardware backed keys are opaque to the operating system and can be used to protect LUKS volumes and as TLS signing keys. The SEL early boot customization (ECB) framework defines a QCOW2 image format including tooling and systemd units to easily generate personalized boot volumes for cVMs.