Elastic Compute Service:Build an OpenClaw confidential AI agent on heterogeneous confidential computing instances

Security architecture

All core data in the Confidential Agent deployment circulates within the TEE boundary. The following three types of assets are strictly protected:

The security architecture covers five layers from bottom to top: hardware, boot chain, runtime, key management, and communication:

Deployment workflow

1. Source code audit: The deployer audits the business source code to confirm no malicious code or backdoors exist.

2. Build artifacts and publish software reference values: Build a lightweight OS image containing only the OpenClaw service from the audited source code, and upload the SLSA signature of the build artifacts to the Rekor transparency log to publish the software reference values.

3. Create a confidential instance: Create a gn8v-tee confidential computing instance by using the built image.

4. Remote attestation audit and upload confidential resources: The deployer uses the deployment tool to perform remote attestation on the instance to verify that it runs on genuine TDX hardware. After verification, confidential resources such as disk encryption keys and DingTalk bot credentials are automatically uploaded.

5. Access OpenClaw: Users can access OpenClaw directly through a web browser, desktop client, or TUI terminal, or indirectly through IM platforms such as DingTalk.

6. Remote attestation audit and encrypted transmission: Before establishing a connection, the trusted gateway client retrieves software reference values from Rekor and hardware reference values from Intel PCCS and RIM/OCSP. After completing remote attestation verification, a RATS-TLS encrypted channel is established. All communication is encrypted end-to-end.

Step 1: Build a trusted image containing OpenClaw and the vLLM inference engine

Complete the following tasks on the deployment machine (an Alibaba Cloud Linux 3 instance): download the source code, install dependencies, generate keys, configure cloud resources, and build the trusted image.

1. Log on to an ECS instance.

   1. Go to ECS console - Instances. In the top-left corner, select the region and resource group for the target instance.

   2. Navigate to the details page of the target instance. Click Connect and select Workbench. Set the connection method to Terminal Connection, enter your username and password, and log on to the graphical terminal.

2. Download the project source code.

   cd ~/
   git clone https://github.com/inclavare-containers/confidential-agent
   cd confidential-agent

3. Install all required software dependencies.

   make install-deps

   This command automatically installs Docker, Terraform, Go, Python, cosign, rekor-cli, and other tools required for building and deployment.

4. Generate the encryption keys and configuration files required for deployment.

   make generate-secrets

   After the keys are generated, edit secrets/openclaw-vllm.json and replace the placeholders with actual values, such as DingTalk application credentials and model configurations. The following table describes the placeholders:

   Placeholder	Description	How to obtain
   <DINGTALK_BOT_CLIENT_ID>	DingTalk bot ClientId	See DingTalk Bot + OpenClaw. Create an application in the DingTalk Developer Portal to obtain the value.
   <DINGTALK_BOT_CLIENT_SECRET>	DingTalk bot ClientSecret	Same as above. Obtain the value from the application details page.

5. Configure the Terraform variable file.

   Note

   Terraform is an open-source Infrastructure as Code (IaC) tool that allows you to automate the creation, modification, and version management of various cloud resources and services on Alibaba Cloud by writing declarative configuration files. In this solution, Terraform is used to automate the deployment of confidential instances.

   cp terraform/terraform.tfvars.example terraform/terraform.tfvars

   Edit the terraform/terraform.tfvars file and configure the key parameters as described in the following table.

   Parameter	Recommended value	Description
   zone_id	"cn-beijing-l"	A zone that supports the gn8v-tee instance family
   vpc_cidr	"10.0.0.0/16"	VPC CIDR block
   vswitch_cidr	"10.0.1.0/24"	vSwitch CIDR block
   security_group_allowed_cidr	The IP CIDR block of the client environment that needs to access the OpenClaw service	Source IP range allowed by the security group

   Important

   The default value of security_group_allowed_cidr is 0.0.0.0/0. In production environments, you must change this value to a specific IP CIDR block and allow only the required source IP addresses.

6. Export your Alibaba Cloud access credentials for Terraform to create cloud resources.

   export ALICLOUD_ACCESS_KEY="<YOUR_ACCESS_KEY>"
   export ALICLOUD_SECRET_KEY="<YOUR_SECRET_KEY>"

   Note

   We recommend that you use a RAM role or temporary credentials (STS) to avoid long-term storage of AccessKey pairs. For information about how to create an AccessKey pair, see Create an AccessKey pair.

7. Build a trusted image that contains OpenClaw and the vLLM inference engine.

   make build PROFILE=openclaw-vllm

   Note

   The first build involves steps such as GPU driver installation. Please be patient.

   After the build is complete, the following two images are generated:

   Image type	Description
   Production image	Security-hardened version with SSH server removed and only the minimal runtime retained, for production deployment
   Debug image	Retains SSH access and debugging tools, for troubleshooting only

   During the build process, image reference values are also uploaded to the Rekor transparency log. A .rekor-meta.json metadata file is generated for verification during deployment.

Step 2: Deploy the trusted image to an instance

Deploy the trusted image to a gn8v-tee instance and establish an end-to-end encrypted channel through TNG.

1. On the deployment machine, run the following command to create a gn8v-tee instance by using the trusted image. After the instance is created, remote attestation is performed on the instance and confidential resources are uploaded.

   make deploy PROFILE=openclaw-vllm RV_MODE=rekor

   The following table describes the key parameters:

   Parameter	Description
   PROFILE=openclaw-vllm	Specifies the deployment profile
   RV_MODE=rekor	Verifies the integrity of image reference values through the Rekor transparency log during deployment

   The deployment process creates the following resources in the cloud:

   • OSS bucket: A private storage space used to upload and host the trusted VM image (.qcow2).

   • ECS custom image: Imported from the OSS image file into the Alibaba Cloud ECS custom image library.

   • ECS GPU confidential computing instance: An ecs.gn8v-tee.4xlarge confidential computing instance attached to the security group and vSwitch. UKI boot parameters include the remote attestation challenge configuration.

   • Security group: Opens SSH (port 22) and TNG (port 18789), allowing access only from the specified CIDR block.

   Note

   By default, the Debug image is deployed. To deploy the Production image (without SSH access), manually specify the image file.

   Important

   During deployment, the image is uploaded to OSS and models are downloaded from ModelScope, which requires Internet access and incurs traffic charges.

2. Start the TNG Client on the deployment machine to establish a RATS-TLS encrypted channel between the deployment machine and the cloud-based gn8v-tee instance.

   make connect-tng

   After a successful connection, the output contains the HTTP and WebSocket URLs and the access token required to access OpenClaw. All subsequent communication is protected by RATS-TLS encryption.

3. Check whether the OpenClaw service is ready through the TNG tunnel.

   curl -s http://localhost:18789/health

   After a healthy status is returned, you can proceed to access the service.

Step 3: Access the OpenClaw service protected by confidential computing

After the service is ready, you can access the OpenClaw service through the following four methods.

ssh -L 18789:127.0.0.1:18789 root@<deployment machine IP>

ssh -L 18789:127.0.0.1:18789 root@<deployment machine IP>

npm install -g openclaw@latest --registry=https://registry.npmmirror.com

openclaw tui --url ws://localhost:18789 --token <gateway-token>

Verify the trustworthiness of the runtime environment

OpenClaw has a built-in tdx-remote-attestation skill that automatically triggers remote attestation when security-related questions are asked, verifying the security status of the current runtime environment.

How to trigger: Ask security-related questions in DingTalk, Web, or TUI, such as "Is my data safe?" or "Is this environment trustworthy?"

Return content:

Verify PEP policy enforcement

PEP (Policy Enforcement Point) is a runtime gating mechanism designed for confidential AI agents. When an agent such as OpenClaw executes a command through the exec tool, the request first passes through cai-pep for policy matching, and then runs in an isolated Docker sandbox (network mode none). Configurable policies enforce mandatory restrictions on the tools available to the agent, preventing security risks caused by malicious prompt injection.

PEP provides three layers of protection:

1. Command-level blocking: Rejects high-risk commands based on a blocklist, such as curl, wget, nc, ssh, and docker.

2. Path-level blocking: Prevents access to sensitive paths, such as /etc, /proc, /root, and /home/openclaw/.openclaw.

3. Network isolation: The sandbox has no network access. Even if a command bypasses the blocklist, it cannot establish outbound connections.

The default policy file is located at ~/confidential-agent/image/customize/files/cai-pep-default-policy.json on the deployment machine. You can modify the command blocklist, path blocklist, and resource limits before building the image.

If an agent is compromised by malicious prompt injection, and an attacker attempts to establish a reverse shell or download a malicious payload, PEP automatically blocks these high-risk operations:

Verify supply chain integrity

The deployment process uses the Rekor transparency log by default to store image reference values. During remote attestation, reference values are automatically retrieved from Rekor for verification. You can audit the Rekor log entries to verify supply chain integrity by using the following methods.

cat ~/confidential-agent/image/output/slsa-output-cai-openclaw-vllm-debug-*/rekor-v1-upload.txt

Created entry at index 1205944956, available at: https://rekor.sigstore.dev/api/v1/log/entries/<uuid>

rekor-cli verify --log-index 1205944956 --rekor_server https://rekor.sigstore.dev

Computed Root Hash: 1291abcee27148a4c00241ba8719f798ce060e8a5ccc8b18249017c25c6d0090
Expected Root Hash: 1291abcee27148a4c00241ba8719f798ce060e8a5ccc8b18249017c25c6d0090

rekor-cli loginfo --rekor_server https://rekor.sigstore.dev

Verification Successful!