live wire
▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security
upstreambeat.ai
guidePLATFORM

Red Hat’s self-encrypting VM prototype joins verified base images to per-VM storage keys

A Fedora Rawhide walkthrough combines dm-verity, TPM2-sealed dm-crypt and a writable overlay, while documenting the integrity gaps that remain.

Verified base image beside encrypted writable VM layer
Side by side: what changed
By The News Desk· Sep 24, 2026the quick take — two AI hosts go live when you do

Red Hat engineer Vitaly Kuznetsov has published a hands-on design for building a VM image that keeps one verifiable base operating-system image while creating a separately encrypted writable layer for each VM. The walkthrough is a Fedora Rawhide prototype rather than a supported product recipe, but it puts concrete commands around a storage problem that confidential-computing deployments still have to solve.

What the design does

Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect data while it is executing, but they do not automatically protect persistent storage. The prototype gives the shared /usr base image runtime integrity with dm-verity, then uses systemd-repart during first boot to create a dm-crypt root partition whose key is sealed to a virtual TPM.

A systemd system extension mounts a writable overlay over /usr. That lets applications see a writable filesystem without copying the complete base image into the encrypted partition at first boot. Red Hat’s walkthrough argues that avoiding that copy matters when a cloud root disk is network-attached and a full transfer could extend boot time.

The build is deliberately explicit. It installs a minimal Fedora Rawhide tree, boots a unified kernel image through shim, signs the system extension, lays out EFI, /usr and dm-verity partitions, and uses QEMU/KVM with Secure Boot and swtpm to test the result. The final checks show /usr backed by the verified base plus overlay and / on the encrypted partition, with changes surviving a reboot.

Why platform teams should care

The useful pattern is the separation of concerns: a fleet can start from one inspectable, integrity-protected base while each instance creates its own encrypted mutable state. That addresses the walkthrough’s requirement that compromising one VM’s key must not expose another VM.

It also makes the trade-off visible. Image builders and confidential-computing teams can reproduce the design with standard Linux components instead of treating storage protection as a black box. The article includes the dnf, systemd-repart, ukify, QEMU and TPM-emulator commands needed to test the path.

What not to assume

Red Hat documents important gaps. The example creates only one overlay partition, does not prove the origin of that encrypted overlay, and lacks integrity and replay-attack protection for mutable data. A malicious host could pre-create an overlay and arrange for its key to be sealed to the guest’s vTPM, creating a code-injection route.

That makes this a useful engineering starting point, not a production security claim. Teams evaluating it should treat origin attestation, mutable-storage integrity and replay resistance as unresolved design requirements before adapting the pattern to confidential OpenShift Virtualization or cloud VM fleets.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk