Limitations

Hardware limitations

• No live migration: Host maintenance triggers user-visible downtime because the Confidential VM cannot be migrated to another host; complete re-attestation is required after the host restarts.
• Fixed vCPU count at creation: You cannot add or remove vCPUs after Confidential VM creation; changing vCPU count requires creating a new VM with an updated image.
• No in-guest restart: Running reboot inside the VM terminates it due to platform configuration. The platform maps in-guest resets to shutdown so that every start runs a fresh attestation handshake. To restart, use the IONOS CLOUD API reboot endpoint.
• No suspend or resume: Suspend or resume is not supported for Confidential VMs.
• No hot-plug devices: You cannot add or remove ram, nic, or disk while the Confidential VM is running; changes require stopping the VM, making the modification, restarting it, and re-attesting.

API and product constraints

• No cloud-init: You must embed image customization into the image at build time because cloud-init is not available.
• No startup volume snapshots: You cannot snapshot startup volumes; you must back up images and manage your build pipeline outside IONOS CLOUD.
• Storage volume resizing only: You can increase storage volume size, but you must expand the LUKS container and filesystem manually from within the Confidential VM.

Operational trade-offs

• Reduced visibility: Host-side tools, memory introspection, live dumps, and external debuggers cannot function because the host cannot decrypt Confidential VM memory. You retain full visibility from within the guest.
• Performance overhead: Memory encryption adds CPU cycles to every memory operation, with memory-intensive workloads being most affected.
• Operational complexity: Managing encryption keys and verifying attestation require specialized expertise and dedicated operational procedures.
• No in-place key rotation: Rotating the volume master key requires rebuilding and redeploying the entire Confidential VM.

Security boundaries (end-users' responsibility)

• Storage encryption: Startup and data volumes are unencrypted by default; you must implement LUKS2 encryption within the image.
• Network encryption: Network traffic is not encrypted by default; you must implement TLS, WireGuard, or VPN encryption within the Confidential VM.
• Application security: Confidential VM protects the VM environment but does not protect against application vulnerabilities, misconfigurations, or dependency exploits.
• Secrets in images: You must never embed secrets in images; instead, use attestation-based secret release to provision secrets securely.
• Side-channel attacks: Simultaneous multi-threading and hyper-threading are always enabled and cannot be disabled per Confidential VM, leaving the system vulnerable to side-channel attacks.

Known issues

• Attestation service unreachable at startup: If you use attestation, you must ensure the attestation service is reachable from the Confidential VM subnet before starting the VM because VPN is not available during the initrd phase.