Sidecar Architecture & Internals
A deep dive into the Linux kernel internals, VSock transport, and PCR0 attestation mechanisms that power the Sovereign Pod.
1. The Fortress Model
Traditional security relies on "IAM Roles" and "Network Policies"-abstractions managed by the cloud provider. We reject this. The Sovereign Pod assumes the host operating system is hostile territory.
The Host (Untrusted)
- × Validates Auth Tokens
- × Handles TCP/IP Networking
- × Manages Storage I/O
- × Has NO Private Keys
The Enclave (Trusted)
- ✓ Holds ECDSA/Ed25519 Keys
- ✓ Executes Signing Logic
- ✓ No Network Access
- ✓ No Persistent Disk
2. Kernel Internals: AF_VSOCK
Communication between the untrusted Host and the Trusted Enclave occurs exclusively via AF_VSOCK, a virtualization-specific socket address family in the Linux kernel. It bypasses the standard TCP/IP stack entirely.
Standard networking requires packet serialization, routing tables, firewalls, and context switches. VSock operates on a shared memory ring buffer between Guest and Host, providing near-zero latency (~15µs RTT).
pub async fn connect(cid: u32, port: u32) -> Result<Self> {
info!("Connecting to enclave CID={} port={}", cid, port);
// Direct kernel connection, no DNS, no routing
let stream = VsockStream::connect(cid, port)
.await
.context("Failed to connect to enclave")?;
Ok(Self { cid, port, stream })
}3. Zero-Copy Architecture
"Zero-Copy" is an ideal we strive for. In the data path, we aim to minimize memory copying between kernel space and user space.
Current Implementation vs. Goal
We currently use serde_json for reliability and debugging. While robust, this involves serialization overhead (CPU cycles).
Moving to rkyv allows us to cast raw bytes from the wire directly into Rust structs without parsing. This is essential for the <50µs latency goal.
4. PCR0 & Remote Attestation
In standard TLS, you trust a server because of a Certificate Authority (CA). In Confidential Computing, you trust the Enclave because of Hardware Attestation from the CPU.
The PCR0 (Platform Configuration Register 0) is a cryptographic hash of the Enclave's entire initial state: Kernel + Init Remote Disk + Application Binary.
If a single byte of the application code changes, the PCR0 hash changes completely. The Enclave cannot lie about its identity because the hash is generated by the TPM hardware, not software.