I have a cloud VM. It's Centos 7 and I used full disk encryption during install. I also installed dropbear SSH to remotely unlock said server in case of a reboot. No one but me have administrative access to the machine. Is there a way to prevent ISP to sniff on my data? I think when I decrypt the server so it can run it stores decryption keys in memory. If my ISP will "snapshot" this machine it will get an image of the memory and can extract the keys, can it? Is there a way to prevent this? Can you encrypt memory?
The general problem here is, that you'd need to save the encryption key somewhere to be able to use it, and then it can be stolen etc. (The same LWN article describes Intel's "Software Guard Extensions", which seems a bit closer to what you'd like but has a hint of DRM smell on it, and apparently requires signatures from Intel...)
If you're running VMs on other people's machines, then you don't own and can't control the hardware, so not putting sensitive data (at least not sensitive keys) there is about the only option you have.