NACRE makes a group of host-managed Linux processes the hardware protection unit at under 3.5% syscall overhead.

arXiv 2609.03849 argues existing confidential computing protects either an enclave address space or a whole guest OS, and container-granularity systems add a separate protection context, so none treats a dynamic group of ordinary Linux processes as the architectural unit. The RISC-V co-design separates the host's authority to manage resources from its authority to access protected state, with hardware-recognized container identities directing protected traps to an isolated S-mode agent. Prototyped across QEMU, OpenSBI, Linux, a trusted agent and runc, three-run means across five lmbench metrics stayed within 3.5% of the runc baseline (arXiv).