BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.all-systems-go.io//all-systems-go-2026//KM8RXB
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-all-systems-go-2026-VNXPQS@cfp.all-systems-go.io
DTSTART;TZID=CET:20261001T112500
DTEND;TZID=CET:20261001T120500
DESCRIPTION:Confidential VM (CVM) instance types are becoming ubiquitous\, 
 with all major cloud providers offering them as a key component for achiev
 ing “zero trust.” While complete zero trust is currently more of a mar
 keting term than a technical reality\, we can acknowledge that CVM technol
 ogies help reduce the Trusted Computing Base (TCB) when utilized properly.
  But do we actually know how to use them effectively?\nWhen transitioning 
 from a world of traditional\, mutable operating systems\, users often expe
 ct to gain security benefits simply by moving their existing workloads to 
 new CVM instance types\, perhaps with some level of attestation. Unfortuna
 tely\, in many cases\, this looks more like a role play in a “security t
 heater”.\nOver the past few years\, we have investigated what security b
 enefits can truly be unlocked when mutable RHEL or Fedora workloads are de
 ployed on confidential VMs\, whether in the public cloud or on-premises. W
 hile immutable OSes offer distinct advantages in such scenarios\, we pose 
 the question: can traditional (mutable) OSes also benefit? Over the last y
 ear\, we have contributed several features to systemd (and other component
 s) that we believe can improve the situation. In particular\, we are focus
 ed on preventing certain attack scenarios against a VM which is normally d
 eployed from a publicly available cloud (marketplace) image. We have furth
 er ideas\, and in this talk\, we will share our vision for how these piece
 s can fit together.
DTSTAMP:20260710T220023Z
LOCATION:Galerie
SUMMARY:Running mutable OS images on Confidential VMs: is there any hope? -
  Vitaly Kuznetsov\, Simran Paul Singh
URL:https://cfp.all-systems-go.io/all-systems-go-2026/talk/VNXPQS/
END:VEVENT
END:VCALENDAR