forked from confidential-containers/td-shim
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
doc: Add introduction text to README
Copy some of the introduction text in the specification to the top-level README. Also add a link to the PDF. Signed-off-by: Christophe de Dinechin <[email protected]>
- Loading branch information
Showing
1 changed file
with
29 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,29 @@ | ||
# td-shim | ||
Confidential Containers Shim Firmware | ||
# TD-shim - Confidential Containers Shim Firmware | ||
|
||
Hardware virtualization-based containers are designed to launch and run | ||
containerized applications in hardware virtualized environments. While | ||
containers usually run directly as bare-metal applications, using TD or VT as an | ||
isolation layer from the host OS is used as a secure and efficient way of | ||
building multi-tenant Cloud-native infrastructures (e.g. Kubernetes). | ||
|
||
In order to match the short start-up time and resource consumption overhead of | ||
bare-metal containers, runtime architectures for TD- and VT-based containers put | ||
a strong focus on minimizing boot time. They must also launch the container | ||
payload as quickly as possible. Hardware virtualization-based containers | ||
typically run on top of simplified and customized Linux kernels to minimize the | ||
overall guest boot time. | ||
|
||
Simplified kernels typically have no UEFI dependencies and no ACPI ASL | ||
support. This allows guests to boot without firmware dependencies. Current | ||
VT-based container runtimes rely on VMMs that are capable of directly booting | ||
into the guest kernel without loading firmware. | ||
|
||
TD Shim is a simplified [TDX virtual firmware](doc/tdshim_spec#vfw) for the | ||
simplified kernel for TD container. This document describes a lightweight | ||
interface between the TD Shim and TD VMM and between the TD Shim and the | ||
simplified kernel. | ||
|
||
## Documents | ||
|
||
* [Introduction (PDF)](doc/td-shim introduction.pdf) | ||
* [TD-Shim specification](doc/tdshim_spec.md) |