How Shopify Governs Containers at Scale with Grafeas and Kritis

Summary

Shopify describes using Grafeas and Kritis to govern container software across a platform handling more than 6,000 container builds per day and 330,000 images in its primary registry. Grafeas serves as a central store for metadata about container origins, builds, base images, layers, registry pulls, installed packages, vulnerabilities, and deployment status, supporting auditing and lifecycle strategies. During CI, audits produce attestations, which Shopify signs with PGP; Kritis uses named attestation authorities and Kubernetes policies to require specific attestations before deployment. Policies can require containers to be built by Shopify, sourced from a trusted repository, free of newly introduced vulnerabilities, tested, non-root, and deployed with the appropriate security context. Shopify also generates attestations from kubeaudit results for workload manifests, helping catch runtime-security regressions before deployment.

Takeaways

1. 1

   Grafeas centralizes metadata about container builds, origins, base images, layers, packages, vulnerabilities, pulls, and deployment status for auditing and lifecycle management.

2. 2

   Kritis policies can require signed attestations from multiple named authorities, such as authorities confirming that a container was built by Shopify and passed testing.

3. 3

   Shopify applies the same attestation model to kubeaudit results for Kubernetes workload manifests, checking runtime-security controls before deployment rather than after.

FAQ