# [Run an application in a Realm using the Arm Confidential Compute Architecture (CCA)](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/)

## In this learning path

- [Introduction](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/)
- [Overview: Realms](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/overview/)
- [Run the Arm CCA stack using a pre-built docker container](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/cca-container/)
- [Run an application in a Realm](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/hello-realm/)
- [Use memory encryption](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/cca-mec/)
- [Next Steps](https://learn.arm.com/learning-paths/servers-and-cloud-computing/cca-container/_next-steps/)

## About this Learning Path

| Skill level: | Introductory |
|--------------|--------------|
| Reading time: | 2 hrs |
| Last updated: | 01 Jul 2026 |

### Authors:
- Pareena Verma, Arm  
  [GitHub](https://github.com/pareenaverma) | [LinkedIn](https://linkedin.com/in/pareena-verma-7853607)
- Arnaud de Grandmaison, Arm  
  [GitHub](https://github.com/Arnaud-de-Grandmaison-ARM) | [LinkedIn](https://linkedin.com/in/arnauddegrandmaison)

### Arm IP:
[Neoverse](https://support.arm.com/?tab=compute-ip&Product%20Type=Infrastructure%20Processors)

### Tags:
- [Performance and Architecture](https://learn.arm.com/tag/performance-and-architecture)
- [Linux](https://learn.arm.com/tag/linux)
- [GCC](https://learn.arm.com/tag/gcc)
- [FVP](https://learn.arm.com/tag/fvp)
- [RME](https://learn.arm.com/tag/rme)
- [CCA](https://learn.arm.com/tag/cca)
- [Docker](https://learn.arm.com/tag/docker)
- [Runbook](https://learn.arm.com/tag/runbook)

### Who is this for?
This is an introductory topic for software developers who want to learn how to run their applications in a Realm using the Arm Confidential Compute Architecture (CCA).

### What will you learn?
Upon completion of this Learning Path, you will be able to:
- Run the Arm reference CCA software stack on an Armv-A AEM Base FVP (Fixed Virtual Platform) with support for RME extensions.
- Create a virtual machine in a Realm running guest Linux using a pre-built docker container.
- Run a simple application in a Realm running guest Linux.
- Obtain a CCA attestation token from the virtual guest in a Realm.
- Run the CCA software stack using MEC (Memory Encryption Contexts).

### Prerequisites
Before starting, you will need the following:
- An AArch64 or x86_64 computer running Linux or macOS. You can use cloud instances, refer to the list of [Arm cloud service providers](https://learn.arm.com/learning-paths/servers-and-cloud-computing/csp/).

### Summary
You’ll run the Arm Confidential Compute Architecture (CCA) reference software stack on an Armv‑A AEM Base FVP with Realm Management Extension (RME) support using a pre-built Docker image. First, you’ll boot a guest Linux virtual machine as a Realm, then inject and run a simple application inside that Realm so the program inherits the Realm’s confidential protections. You’ll also obtain a CCA attestation token from the Realm guest and learn about Memory Encryption Contexts (MEC) and how the CCA stack can run with multiple encryption contexts in the Realm Physical Address Space. By the end, you’ll see the Realm guest launch, run the injected app, and produce an attestation token.

### Frequently asked questions

<details>
<summary>Which Docker image does this path use, and how do I confirm it downloaded?</summary>
Pull `armswdev/cca-learning-path:cca-simulation-v3`. Run `docker image list` and check that this repository and tag appear in the output.
</details>

<details>
<summary>What result should I expect when the Realm guest virtual machine starts?</summary>
The guest virtual machine (VM) should boot as a Realm and run guest Linux. Continue when the VM is up and ready for the application injection step.
</details>

<details>
<summary>How do I place the sample application inside the Realm?</summary>
Inject the application into the guest filesystem as shown in the steps. Verify inside the guest that the file exists and is executable, then run it to confirm expected output.
</details>

<details>
<summary>Where do I retrieve the CCA attestation token in this workflow?</summary>
Request the token from inside the virtual guest running in the Realm. Follow the path step to capture the token and confirm that a token is returned.
</details>

<details>
<summary>What changes when running with Memory Encryption Contexts (MEC)?</summary>
Use the MEC section to run the CCA stack with multiple encryption contexts in the Realm Physical Address Space, identified by a MECID. The example follows the same Realm guest and application flow while enabling MEC.
</details>