A computer-implemented method for securing pods in a container orchestration environment, the computer-implemented method comprising: verifying, by the computer, using an agent embedded in a trusted execution environment of the computer, a digital signature of the trusted execution environment contract included in a pod sandbox virtual machine with the set of containers that corresponds to the service deployed in the trusted execution environment based on a contract verification key corresponding to an application owner providing the service in the container orchestration environment; verifying, by a computer, using the agent, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to the service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in the trusted execution environment contract included in the pod sandbox virtual machine of the trusted execution environment; determining, by the computer, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract; and responsive to the computer determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract, executing, by the computer, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment. verifying, by the computer, using an agent embedded in a trusted execution environment of the computer, a digital signature of the trusted execution environment contract included in a pod sandbox virtual machine with the set of containers that corresponds to the service deployed in the trusted execution environment based on a contract verification key corresponding to an application owner providing the service in the container orchestration environment; verifying, by a computer, using the agent, a container runtime interface command to perform an orchestration action on a set of containers comprising an application workload that corresponds to the service hosted by the container orchestration environment based on matching the container runtime interface command to a rule contained in the trusted execution environment contract included in the pod sandbox virtual machine of the trusted execution environment; determining, by the computer, using the agent, whether the container runtime interface command to perform the orchestration action on the set of containers is valid based finding a matching rule in the trusted execution environment contract; and responsive to the computer determining, using the agent, that the container runtime interface command to perform the orchestration action on the set of containers is valid based on finding the matching rule in the trusted execution environment contract, executing, by the computer, using the agent, the container runtime interface command to perform the orchestration action on the set of containers comprising the application workload that corresponds to the service in the pod sandbox virtual machine of the trusted execution environment.