Prerequisites and installation

Prerequisites

Hardware requirements

  • AMD SEV-SNP-capable CPU

  • Ubuntu Server 26.04

User requirements

You should use a non-root user with sudo permissions to perform the installation, setup, and management of Anjuna Confidential Containers on your target bare metal host.

Get the installer

Access the Anjuna Resource Center to download Anjuna Seaglass for AMD SEV-SNP on Bare Metal.

You can use the “API” button to copy a wget command to download Anjuna Seaglass for AMD SEV-SNP on Bare Metal to your local environment from the command line, without the need to access the Anjuna Resource Center UI again.

Software Bill of Materials

The release package includes the Software Bill of Materials (SBOM), providing full transparency into all components, libraries, and modules comprising the software. It is located in the file sbom.csv at the root directory of the extracted package.

Host setup

Before using the Anjuna Seaglass for AMD SEV-SNP on Bare Metal tool suite, you must enable AMD SEV-SNP within your BIOS settings. Please ensure that your BIOS has been updated to the latest version. As BIOS settings can vary based on vendor, check the vendor documentation for your BIOS for full details on making these changes.

The following shows how SEV-SNP would be enabled for the standard AMD BIOS:

CBS -> CPU Common ->
              SEV-ES ASID space Limit Control -> Manual
              SEV-ES ASID space limit -> 100
              SNP Memory Coverage -> Enabled
              SMEE -> Enabled
    -> NBIO common ->
              SEV-SNP -> Enabled

Verifying SEV-SNP is enabled

The following commands can be used to check that SEV-SNP has been enabled correctly:

$ sudo dmesg | grep -i -e rmp -e sev

The output should include lines similar to the following:

SEV-SNP: RMP table physical range [0x0000000043c00000 - 0x00000000741fffff]
ccp 0000:06:00.5: sev enabled
ccp 0000:06:00.5: SEV-SNP API:1.55 build:40
ccp 0000:06:00.5: SEV API:1.55 build:40
kvm_amd: SEV enabled (ASIDs 100 - 1006)
kvm_amd: SEV-ES enabled (ASIDs 1 - 99)
kvm_amd: SEV-SNP enabled (ASIDs 1 - 99)

You can also verify the setup of your host by checking the following kernel module parameters:

$ cat /sys/module/kvm_amd/parameters/sev
Y
$ cat /sys/module/kvm_amd/parameters/sev_es
Y
$ cat /sys/module/kvm_amd/parameters/sev_snp
Y

Installation

Install the tools

Use the following commands to perform a local install of Anjuna Seaglass for AMD SEV-SNP on Bare Metal:

$ sudo mkdir -p /opt/anjuna/metal
$ sudo tar -C /opt/anjuna/metal -xf anjuna-metal.release*.tar.gz

Set up environment variables

To access the tools, source the env.sh file:

$ source /opt/anjuna/metal/env.sh

You can add the line above to your ~/.bash_profile to automatically set these environment variables every time you log in.

Verify prerequisites

Anjuna Seaglass for AMD SEV-SNP on Bare Metal ships two role-specific scripts that verify a host meets the prerequisites for its role:

  • /opt/anjuna/metal/disk-init.sh for hosts that build Anjuna Confidential Container disk images.

  • /opt/anjuna/metal/instance-init.sh for hosts that run Anjuna Confidential Containers on AMD SEV-SNP hardware.

If a single host both builds disk images and runs Anjuna Confidential Containers, run both scripts.

Each script prints the command needed to satisfy any unmet prerequisite. Apply them as suggested.

Disk-build host

$ /opt/anjuna/metal/disk-init.sh

The script verifies:

  • That docker.io, jq, pv, parted, e2fsprogs, and dosfstools are installed.

  • That the current user belongs to the docker group.

Instance-run host

$ /opt/anjuna/metal/instance-init.sh

The script verifies:

  • That libvirt-daemon-system, libvirt-clients, qemu-system-x86, and acl are installed.

  • That the current user belongs to the libvirt group.

  • That libvirtd is running and enabled at boot.

  • That /dev/sev is present and that its group and mode are kvm:0660, persisted by a udev rule.

  • That libvirt’s default network is started and set to autostart.

  • That /etc/libvirt/qemu.conf lists /dev/sev and /dev/kvm in cgroup_device_acl.

  • That /var/lib/anjuna exists with root:libvirt ownership and POSIX ACLs that grant the libvirt group write access and the libvirt-qemu user read access.

If either script reports unmet checks, apply the printed commands and re-run. When the script adds your user to a new group, log out and back in for the change to take effect.