The only GPU tier whereyou generate the attestation.
A full Intel TDX virtual machine, Ubuntu 24.04, full root over SSH, GPU attached. Inside it, /dev/tdx_guest belongs to you: generate your own signed TDX quote with your own 64-byte challenge, and verify it offline against Intel, never against us.
Both proofs verified on three single-GPU SKUs, from 3.80 $/h on the RTX PRO 6000 Blackwell, billed per second with no minimum: a ten minute test costs about 63 cents. The raw evidence for every attested SKU is published, checksums included.
Full technical guide, with the pitfalls tenants found (report stability, concurrent quotes) and downloadable artifacts: docs.voltagegpu.com/pods/confidential-vm.
§ 01 / method
Five commands, verified end to end
No vendor SDK, no API of ours in the loop. Just the Linux kernel’s standard configfs TSM interface. Verified live on September 3, 2026.
# Inside your Confidential VM (Ubuntu 24.04, Intel TDX) ls -l /dev/tdx_guest lsmod | grep -E "tdx_guest|tsm" # Generate a quote with YOUR 64-byte challenge sudo mkdir /sys/kernel/config/tsm/report/r1 sudo dd if=report_data.bin of=.../r1/inblob sudo cat .../r1/outblob > quote.bin # 5,247 bytes, TDX quote v4 # Verify OFFLINE with Intel DCAP, against Intel's root CA. # We are not in the trust path.
§ 02 / comparison
Container tier vs. Confidential VM tier
§ 03 / pricing
Confidential VM pricing
Per-second billing, no minimum. Priced above the container tier because tenant-side attestation is a distinct capability nothing else on the market offers at this price point, Azure confidential GPU runs roughly $12.50/hr.
These four are the entire VM tier. B200 and B300 are not offered as Confidential VMs, and the confidential container tier was retired by our provider on 1 October 2026. NVIDIA GPU attestation has been verified by us on the single-GPU H200, the 8x H100 node, the single-GPU H100 and the single-GPU RTX PRO 6000 Blackwell. Prices reflect the current Confidential VM markup. Live inventory: /live-prices.
§ 04 / use cases
What tenant-generated quotes unlock
§ 05 / honest limits
What this does not give you today
FAQ
Common questions
How is this different from the standard confidential container tier?
The container tier does not expose /dev/tdx_guest inside your workload. CPU attestation exists at the infrastructure level there, but you cannot generate a tenant quote with your own report_data from inside a container. The Confidential VM tier gives you the device directly, with full root over SSH.
Does the attestation quote cover the GPU?
The TDX quote covers the CPU trust domain only, but on H200 VMs the GPU has its own attestation. GPU confidential-computing mode is ON on single-GPU H200 VMs (verified September 4, 2026: nvidia-smi conf-compute reports CC State ON in production mode, all 141 GB of GPU memory protected), and the GPU produces a nonce-bound attestation report that NVIDIA's remote attestation service verified. On the 8x H100 node the GPUs run in NVIDIA's multi-GPU Protected PCIe mode and NVIDIA's remote service attested all eight of them on September 10, 2026 (NVSwitch attestation not yet verified). Single-GPU H100 VMs were attested on 16 September 2026 (CC State ON, all GPU memory protected) and RTX PRO 6000 Blackwell VMs on 17 September 2026, last re-run 9 October 2026 (CC State ON, NVIDIA remote attestation successful on a caller nonce, evidence at /blog/two-proofs/evidence/rtx6000b-2026-10-09/). The 8x H200 node reads the same mode but we have not run its attestation yet. The confidential container tier, which gave the tenant no attestation, was retired on 1 October 2026. We never represent the TDX quote as GPU-side evidence: ask for the NVIDIA report separately.
Can our own auditors run the verification themselves?
Yes, that is the entire point. SSH access and full root are included. An auditor can generate their own nonce-bound quote and verify it offline with Intel DCAP against Intel’s root CA, with no VoltageGPU API or credential anywhere in that chain.
How fast can we get a VM?
About two minutes. Pick a tier on the deploy page, give it a name, and it boots with your SSH key already on it. You need an SSH key on your account first, because a Confidential VM binds its keys at creation and can never be given one afterwards.
Are there persistent volumes?
Not yet on this tier. Treat the VM disk as ephemeral and copy quotes and artifacts off the box before the session ends. Persistent volumes are on the roadmap.
Run the five commands on your own VM
Deploy one from your dashboard and it boots in about two minutes, with your SSH key already on it. Generate your first tenant-side TDX quote in the next five minutes.