SSC combines hardware, software, and middleware and is unique to IBM Z platform.  Although it is called a Container, it should not be confused with purely software Open Source  containers (such as Kubernetes or Docker). SSC is a part of the Pervasive Encryption concept that was introduced with IBM z14, which is  aimed at delivering best IBM Security hardware and software enhancements, services, and  practices for 360-degree infrastructure protection. LPAR is defined as SSC by using Hardware Management Console (HMC). The SSC solution offers the following advantages: All diagnostic information (debug dump data, and logs) are encrypted and do not contain  any user or application data. After the SSC appliance is built, Secure Shell (SSH) and command line-interface (CLI) are  disabled, which guarantees that even system administrators cannot access the contents of  SSC and do not know what application is running there. SSC- eligible applications are booted into SSC by using verified booting sequence, where  only trusted and digitally signed and verified by IBM software code is uploaded into the  SSC. SSC is a powerful IBM technology for providing the extra protection of the most sensitive  workloads. The integration with other applications in transparent; all services can be called  externally by standard REST APIs. The z/VSE Network Appliance builds on the z/VSE Linux Fast Path (LFP) function and  provides Internet Protocol network access without requiring a TCP/IP stack in z/VSE. The  appliance uses the SSC infrastructure that was introduced on z13 and z13s servers.  Compared to a TCP/IP stack in z/VSE, this network appliance can support higher TCP/IP  traffic throughput while reducing the processing resource consumption in z/VSE. IBM z/VSE Network Appliance GLYPH<SM590000> Existing applications require zero changes to use SSC; software developers do not need  to write any SSC-specific programming code. GLYPH<SM590000> End-to-end encryption of data in-flight and at-rest: – Automatic Network En cryption (TLS, IPSEC); data in-flight. – Automatic File System Encryption (LUKS); data at-rest. – Linux Unified Key Setup (LUKS) is the standard way in Linux to provide disk  encryption. SSC encrypt all data with a key that is stored within the appliance – Protected memory: Up to 16 TB can be defined per SSC LPAR. GLYPH<SM590000> Encrypted Diagnostic Data GLYPH<SM590000> No operating system access GLYPH<SM590000> Applications that run inside SSC are accessed externally by REST APIs only, in a  transparent to user way. GLYPH<SM590000> Tamper-proof SSC Secure Boot GLYPH<SM590000> Vertical workload isolation, which is certified by EAL5+ Common Criteria Standard, which  is the highest level that ensures workload separation and isolation. GLYPH<SM590000> Horizontal workload isolation, which is a separation from the rest of the host environment. Chapter 1. Introduction  9