# Release Notes for v0.17.0

Release Date: November 21st, 2025

This release is based on [3.23.0](https://github.com/kata-containers/kata-containers/releases/tag/3.23.0) of Kata Containers
and [v0.11.0](https://github.com/confidential-containers/enclave-cc/releases/tag/v0.11.0) of enclave-cc.

Trustee and the guest components use KBS protocol v0.4.0.

Please see the [quickstart guide](https://confidentialcontainers.org/docs/getting-started/) or [project documentation](https://confidentialcontainers.org/docs) for more information.

## Deprecation Notices
* Support for process-based confidential computing via enclave-cc will be removed in the v0.18.0 release.
  The enclave-cc project will be archived.
* The community is working on a helm-based replacement for the CoCo Operator. This will likely be
  the last release with the operator. If you have any key requirements for the operator replacement
  please share them with the community on GitHub or Slack.
  The new charts repository can be found [here](https://github.com/confidential-containers/charts).
* The Cloud API Adaptor will drop support for the experimental Secure Comms mode in the next release.
* The Cloud API Adaptor will drop support for the vSphere provider in the next release.
* The Cloud API Adaptor is moving away from building guest images with packer in favor of mkosi.
  Support for packer images will be dropped in some future release.

If you require any of these features, please let the upstream community know immediately.

## What's New

* Improvements to PKCS11 support in Trustee.
* Docker Compose Trustee checks attestation token signatures by default.
* Trustee CLI too introduced. More features are in development.
* Trustee can verify certain NVIDIA GPUs via NRAS.
* Trustee has basic support for validating TPMs.
* Trustee admin backend has been improved to support multiple admin keypairs.
* The simple attestation token was removed per the deprecation process.
* Improvements to logging in the Attestation Service.
* Individual reference values are provided to the AS Policy via a Rego extension
  rather than via one large map.
* If CDH.toml or AA.toml are provided via init-data, AS will parse these files
  as JSON to expose them to the policy and include them in the token.
* InitData plaintext can be provided via KBS Client and Trustee Attester.
* Astral-Tokio-Tar updated to avoid CVE.
* Image-rs can handle images with absolute path hard links.
* Helm-based deployment being tested as operator replacement.

## Hardware Support

Attestation is supported and tested on three platforms: Intel TDX, AMD SEV-SNP, and IBM SEL.
Not all features have been tested on every platform, but those based on attestation
are expected to work on the platforms above.

Make sure your host platform is compatible with the hypervisor and guest kernel
provisioned by CoCo.

This release has been tested on the following stacks:

### AMD SEV-SNP

* Processor: AMD EPYC 7413
* Kernel: 6.16.1
* OS: Ubuntu 22.04.4 LTS
* k8s: v1.33.0 (Kubeadm)
* Kustomize: v5.6.0

### Intel TDX

* Kernel: 6.8.0-1028-intel (kobuk)
* OS: Ubuntu 24.04 LTS
* k8s: v1.34.2 (Kubeadm)
* Kustomize: v5.3.0

### IBM Secure Execution for Linux (SEL)

* Hardware: IBM Z16 LPAR
* Kernel: 6.8.0-87-generic
* OS: Ubuntu Ubuntu 24.04.2 LTS
* k8s: v1.31.1 (Kubeadm)
* Kustomize: v5.7.1

## Limitations

The following are limitations and known issues with this release.

* Credentials for authenticated registries are exposed to the host.
* Not all features are tested on all platforms.
* Nydus snapshotter support is not mature.
  * Nydus snapshotter sometimes fails to pull an image.
  * Host pulling with Nydus snapshotter is not yet enabled.
  * Nydus snapshotter is not supported with enclave-cc.
  * There is an experimental option to force guest image pull without a snapshotter.
    This is also not mature and must be manually configured.
* Pulling container images inside guest may have negative performance implications including greater resource usage and slower startup.
* `crio` support is still evolving.
* Platform support is rapidly changing
* SELinux is not supported on the host and must be set to permissive if in use.
* Complete integration with Kubernetes is still in progress.
  * Existing APIs do not fully support the CoCo security and threat model. [More info](https://github.com/confidential-containers/confidential-containers/issues/53)
  * Some commands accessing confidential data, such as `kubectl exec`, may either fail to work, or incorrectly expose information to the host
* The CoCo community aspires to adopting open source security best practices, but not all practices are adopted yet.
