As the adoption of confidential computing gains momentum, a question we often get asked is: why would I need confidential computing in my private data center? While it is true that confidential computing has often been associated with addressing security concerns in public cloud environments, its value proposition extends well beyond that.

Confidential computing threat model

To answer this question, we must first understand the underlying threat model of confidential computing. In the public cloud, confidential virtual machines (CVMs) establish a new trust boundary for workloads by encrypting the workload in main memory. This prevents the host operating system, hypervisor, and DMA-capable devices from accessing the sensitive data. Even if these components were compromised, your CVM’s data would still be protected. Without confidential computing, the millions of lines of code comprising the cloud’s system software would have unrestricted access. Moreover, CVMs also protect workloads from the cloud’s operators.

Your private data center is not confidential

Some argue that private data centers have inherent advantages such as data governance, control, and physical security. And that is all true. Whether your data is encrypted or in plaintext, you always have the authority to decide where it resides, how it is backed up and who can access your server room. 

Governance vs security

However, it is important to distinguish between data governance and security. Maintaining control over data is definitely not synonymous with security. You can control where your data lives and still have it be compromised.  

In fact, your on-premises servers are still vulnerable to insiders’ attacks, and they also run the same privileged system software found in the public cloud. Therefore, they are susceptible to the same vulnerabilities and security risks. 

To get a better sense of the scale of this issue, look no further than your organization’s IT system logs, and how many CVEs you have to routinely patch for your data center servers. For example, If you are running a Linux host operating system, then you likely had to patch around 400 CVEs in 2022 alone, half of which had either high or critical severity.  

Without confidential computing, any one of these CVEs, if exploited, could leak your data and compromise its integrity. With confidential computing in place, you can take all this system software, which will certainly be found to be vulnerable at some point, and put it outside of your confidential workload’s trust boundary. A host OS exploit, for instance, would have absolutely no security impact on your workload. 

This point about the need for confidential computing in the private data center is not immediately obvious to many of the customers we talk to. The confusion is also compounded by the public cloud provider’s messaging, which advertises the technology as a way to gain “the same level of security as a private data center”, and thus, incentivizes more people to move to the public cloud.

Ubuntu confidential computing

Ubuntu 26.04 LTS now supports both Intel TDX and AMD SEV-SNP across host and guest, enabling enterprises to deploy confidential virtual machines on their own compatible hardware. The kernel, virtualisation components and guest firmware are integrated into an LTS platform, so you can use Ubuntu both on the physical server and inside the confidential VM.

And with Ubuntu confidential VMs being present in all major cloud providers, you can confidently build your hybrid multi-cloud confidential computing strategy to protect your data wherever it is deployed.

New hardware capabilities on an LTS foundation

Ubuntu 26.04 LTS also introduces an opt-in virtualisation Hardware Enablement (HWE) stack, extending the existing kernel HWE model to QEMU, libvirt, and VM firmware. During the first two years of the LTS, these components are upgraded every six months to newer versions supported in Ubuntu, enabling you to adopt new capabilities while retaining your LTS base.

For confidential computing, this provides a path to features such as trusted device assignment, accelerator support and confidential VM migration as the necessary hardware and software support matures.

Learn more about Ubuntu’s virtualisation HWE stack.

Learn more about Ubuntu security

If you would like to know more about the Canonical approach to security at large, contact us. 

Additional resources

• Ubuntu Pro | product page
• Watch our webinar to learn more about confidential computing
• Read our blog post for “What is confidential computing? A high-level explanation for CISOs”
• Read our blog post for “Confidential computing in public clouds: isolation and remote attestation explained”
• Start creating and using Ubuntu CVMs on Azure
• Is Linux Secure?