You want technical assurance that the environment you are creating has not been tampered with; the Secure Build process verifies the authenticity.

Since the addition of Bring Your Own Image to deploy custom images in IBM Cloud Hyper Protect Virtual Servers, clients are finding that there are countless opportunities to secure workloads in a public cloud environment. You can bring any supported type of image from a repository of your choosing, such as IBM Cloud Registry or Docker Hub, and gain the security benefits of Hyper Protect. As you work with these new customized environments, the cloud admin lockout is key to protecting applications in the cloud, but what about internal threats? You need a process to verify that a custom image is deployed with no tampering.

What are IBM Cloud Hyper Protect Virtual Servers?

Designed to address the topmost security concerns, Hyper Protect Virtual Servers provide a confidential computing environment to protect data and applications. Hyper Protect Virtual Servers provide technical assurance that workloads are protected in the cloud, meaning there is technology that prevents access by unauthorized users. Not even IBM Cloud administrators have access — a key differentiator. There is more than just an operational assurance, or promise, that IBM will not access the virtual server. All of this comes without sacrificing on performance or scalability.

What is Secure Build?

Secure Build is a process to build and deploy images using a trusted source and method. It creates a repeatable and definable process to create the images that is approved by the organization — in this case, you. This includes security checks throughout to verify that nothing abnormal or malicious is included in the containerized image. If any of these checks fail, the image will be rejected. In addition, the build automation process itself is encrypted within its own enclave, protected from all tampering. In summary, Secure Build allows you to inject audit capabilities in the build process, which ensures all images that are published and deployed are approved and signed by a security audit team.

This process starts with the developer writing the code for an application, all the way over to the final product that is deployed and maintained within the Virtual Server. The process guarantees the integrity of an image by inspecting each image before it is deployed and checks against the defined Secure Build Process so that it can verify what content resides within the image and that only authorized users can see the application, which protects against even internal administrators. This process can even be expanded out to include multiple users for an approval process, similar to requiring multiple authentications to unlock a secret.

How to use

When deploying an image using the Secure Build process, the enclave is highly isolated, meaning that developers must use a specific API to access the Secure Build Server (SBS). Neither Service Provider Admins (IBM Cloud Admins) nor System Admins (internal) can access the SBS or its contents. The application image created by the SBS (together with other relevant build output, such as the manifest file and encrypted registration file) is highly secured.

There are a couple easy steps to build an image using the Secure Build Process:

  1. Set up a Secure Build Server instance and use the Command Line Interface (CLI) to start the build using this instance.
  2. Pull the source code from a repository (such as GitHub) and use the source code’s Dockerfile to build an image.
  3. Sign the image and push it to a container registry (such as IBM Container Registry or Docker Hub).
  4. Create the manifest file and sign it (this verifies the source of the image and the integrity of the build).
  5. Create an encrypted registration file.
  6. Provision an instance of the application on Hyper Protect Virtual Servers using Bring Your Own Image.

For more details, please visit the Secure Build documentation and check out this tutorial — Using a Secure Build Server with a Digital Wallet.

Get started today

All users can get started with a 30-day free trial period to evaluate a Hyper Protect Virtual Servers instance. Try it now!

IBM Cloud Hyper Protect Virtual Servers are available today in the following Multi-Zone Regions (MZRs): Dallas, Washington D.C., Frankfurt and Sydney

Additional resources


More from Cloud

Kubernetes version 1.28 now available in IBM Cloud Kubernetes Service

2 min read - We are excited to announce the availability of Kubernetes version 1.28 for your clusters that are running in IBM Cloud Kubernetes Service. This is our 23rd release of Kubernetes. With our Kubernetes service, you can easily upgrade your clusters without the need for deep Kubernetes knowledge. When you deploy new clusters, the default Kubernetes version remains 1.27 (soon to be 1.28); you can also choose to immediately deploy version 1.28. Learn more about deploying clusters here. Kubernetes version 1.28 In…

Temenos brings innovative payments capabilities to IBM Cloud to help banks transform

3 min read - The payments ecosystem is at an inflection point for transformation, and we believe now is the time for change. As banks look to modernize their payments journeys, Temenos Payments Hub has become the first dedicated payments solution to deliver innovative payments capabilities on the IBM Cloud for Financial Services®—an industry-specific platform designed to accelerate financial institutions' digital transformations with security at the forefront. This is the latest initiative in our long history together helping clients transform. With the Temenos Payments…

Foundational models at the edge

7 min read - Foundational models (FMs) are marking the beginning of a new era in machine learning (ML) and artificial intelligence (AI), which is leading to faster development of AI that can be adapted to a wide range of downstream tasks and fine-tuned for an array of applications.  With the increasing importance of processing data where work is being performed, serving AI models at the enterprise edge enables near-real-time predictions, while abiding by data sovereignty and privacy requirements. By combining the IBM watsonx data…

The next wave of payments modernization: Minimizing complexity to elevate customer experience

3 min read - The payments ecosystem is at an inflection point for transformation, especially as we see the rise of disruptive digital entrants who are introducing new payment methods, such as cryptocurrency and central bank digital currencies (CDBC). With more choices for customers, capturing share of wallet is becoming more competitive for traditional banks. This is just one of many examples that show how the payments space has evolved. At the same time, we are increasingly seeing regulators more closely monitor the industry’s…