A computing system comprising: one or more processors; and one or more computer-readable storage medium having stored computer executable instructions which are executable by the one or more processors for implementing a method for creating a container-based memory enclave, the method comprising: identifying a container image having a security component that is used for attesting to a particular security configuration that is used by a host system running on a first security domain, the security component being stored at a memory address of the host system; using the container image to instantiate a new container, the new container being configured to utilize enclave memory in a second security domain of a host system based on a security component stored at an address of the host system, the new container including a copy of the security component with a particular memory address that is a purported link from the container to the memory address of the security component stored at the host system; and during or after instantiation of the new container, modifying the purported link from the container to the particular memory address of the security component stored at the host system so that the purported link from the container to the memory address is modified to verifiably link the container to the memory address of the host system. one or more processors; and one or more computer-readable storage medium having stored computer executable instructions which are executable by the one or more processors for implementing a method for creating a container-based memory enclave, the method comprising: identifying a container image having a security component that is used for attesting to a particular security configuration that is used by a host system running on a first security domain, the security component being stored at a memory address of the host system; using the container image to instantiate a new container, the new container being configured to utilize enclave memory in a second security domain of a host system based on a security component stored at an address of the host system, the new container including a copy of the security component with a particular memory address that is a purported link from the container to the memory address of the security component stored at the host system; and during or after instantiation of the new container, modifying the purported link from the container to the particular memory address of the security component stored at the host system so that the purported link from the container to the memory address is modified to verifiably link the container to the memory address of the host system. identifying a container image having a security component that is used for attesting to a particular security configuration that is used by a host system running on a first security domain, the security component being stored at a memory address of the host system; using the container image to instantiate a new container, the new container being configured to utilize enclave memory in a second security domain of a host system based on a security component stored at an address of the host system, the new container including a copy of the security component with a particular memory address that is a purported link from the container to the memory address of the security component stored at the host system; and during or after instantiation of the new container, modifying the purported link from the container to the particular memory address of the security component stored at the host system so that the purported link from the container to the memory address is modified to verifiably link the container to the memory address of the host system.