🌩️ Thunder: How Confidential Containers Protect Your Kubernetes Workloads (Even From Your Cloud Provider)