How to Deploy Confidential Computing Workloads on OpenMetal Infrastructure

Updated on November 6, 2025 by Jen Royle-Jones

How to Deploy Confidential Computing Workloads on OpenMetal Infrastructure

Confidential computing workloads on bare metal is a new approach to protecting sensitive data—not just when it’s stored or transmitted, but while it’s actively being used. With growing security concerns and stricter data regulations, more organizations are asking how to make this a practical part of their infrastructure.

In this blog, we’ll break down how you can use OpenMetal’s bare metal servers to support confidential workloads using Intel TDX. Whether you’re working with protected health data, training machine learning models, or handling financial transactions, OpenMetal gives you the tools and control to keep it secure.

For a broader look at the technology, see our overview on Confidential Computing Benefits and Use Cases.

What You Need for Confidential Computing Workloads

To build a confidential computing environment, you’ll need:

  • Hardware-level security features like Intel TDX (Trust Domain Extensions)
  • Trusted Execution Environments (TEEs) that isolate data in memory
  • Operating systems and hypervisors that support those features
  • Full control over the hardware and how it’s configured

Note: Intel® Software Guard Extensions (SGX), Intel® Trust Domain Extensions (TDX), AMD® SEV, and Arm® TrustZone are examples of hardware-based TEEs.

Why OpenMetal Is a Fit for Confidential Computing Workloads

OpenMetal gives teams the flexibility and access they need to deploy secure workloads:

  • Bare Metal Control: Full access to physical servers without shared tenants
  • Intel 5th Gen CPUs with TDX: Available on our Medium V4, Large V4, XL V4, and XXL V4 bare metal configurations. You can also add H100 GPUs to XXL V4 servers for workloads that need acceleration.
  • GPU Support via PCIe Passthrough: You can attach the H100 to Intel TDX-enabled VMs using PCIe passthrough.
  • Fast, Isolated Networking: Redundant 10Gbps with VLAN segmentation
  • Encrypted Storage: Attach encrypted volumes to workloads as needed
  • Open APIs and CLI: Automate secure deployments

A Practical Guide to Deploying Confidential Workloads on OpenMetal

  1. Choose Intel TDX-Ready Hardware: Use OpenMetal’s Medium, Large, XL, or XXL configurations featuring 5th Gen Intel CPUs and optional H100 GPUs on the XXL. These servers come configured to launch TDX-enabled virtual machines.
  2. Deploy Virtual Machines with Intel TDX: Launch TDX-enabled VMs on supported nodes. These VMs benefit from memory and execution isolation from other workloads and the hypervisor.
  3. Attach GPUs with PCIe Passthrough (Optional): If your workload requires a GPU, the H100 can be passed through directly to your TDX-enabled VM using PCIe passthrough. This enables GPU acceleration while keeping CPU and memory data isolated.
  4. Secure Storage and Networking: Use encrypted volumes and VLAN-based network isolation to strengthen your setup. These security layers support the integrity and protection of your environment.
  5. Monitor and Validate: Deploy internal tools or third-party solutions to validate the state of your confidential computing environment. Monitoring configurations and access helps ensure ongoing protection and compliance.

Common Use Cases

  • Healthcare: Analyze PHI while maintaining HIPAA compliance
  • AI/ML: Protect training data and proprietary models
  • Finance: Run encrypted models for fraud detection or trading
  • Web3/Crypto: Safeguard wallet data and blockchain metadata from exposure

 

Final Thoughts 

Confidential computing workloads are already making an impact across real-world production environments. OpenMetal provides a reliable path to deploying secure infrastructure through Intel TDX-enabled hardware and GPU passthrough capabilities.

If you’re ready to explore confidential computing, contact our team to get started.

Read More on the OpenMetal Blog

Utilization Is a Tenancy Decision: Why Sustained MFU Lives Below the Kernel

On latency-bound inference, the Model FLOPs Utilization your optimization stack can actually hold is capped by who else shares the box, not by the kernel that runs on it. Sustained

Read More

The Real Cost Math Behind Self-Hosted GitHub Actions Runners

We work through the actual cost crossover between GitHub-hosted Actions runners and self-hosted runners on dedicated bare metal, using GitHub’s current 2026 rates, correct a common misconception about a self-hosted runner fee that never took effect, and cover what a self-hosted build pipeline needs beyond just cheaper compute.

Comparing OpenMetal, Hetzner, and OVHcloud for Proxmox VE Hosting

We compare three dedicated server providers commonly considered for Proxmox VE hosting, OpenMetal, Hetzner, and OVHcloud, across real hardware specs, current pricing, storage architecture, and support model, so you can match the provider to your actual workload rather than just the sticker price.

Infrastructure for Post-Quantum Cryptography and Crypto-Agility

We look at why post-quantum cryptography has moved from a research topic to a binding compliance deadline, why “harvest now, decrypt later” makes this an infrastructure problem today rather than a future one, and why crypto-agile key management needs hardware you control directly.

Infrastructure for GENIUS Act Stablecoin Reserve and Redemption Systems

We look at what the GENIUS Act actually requires of payment stablecoin issuers, why reserve tracking, redemption, and transaction monitoring systems need dedicated and auditable infrastructure rather than shared platforms, and where that requirement does and doesn’t touch broader blockchain infrastructure.

What US CLOUD Act Jurisdiction Means for Your Singapore Infrastructure

We answer a specific legal question that general Singapore sovereignty content doesn’t: whether US CLOUD Act jurisdiction reaches infrastructure physically hosted in Singapore, how that’s separate from Singapore’s own PDPA framework, and what that means if you’re evaluating a US-owned infrastructure provider for APAC deployment.

Self-Hosting an AI Agent Code Execution Sandbox on Bare Metal

We explain why AI agents that execute code need microVM-level isolation, why that isolation requires direct hardware access that public cloud VMs can’t provide, and how self-hosting a Firecracker or Kata sandbox on dedicated bare metal compares to managed platforms like E2B on cost and control.

Running Confidential Computing Workloads in the EU in Amsterdam

We explain what Intel TDX confidential computing actually protects, confirm which hardware configuration delivers it in our Amsterdam data center today, and walk through why pairing TDX with EU data residency matters for regulated workloads.