---
title: "How Shopify Governs Containers at Scale with Grafeas and Kritis"
description: "Shopify describes using Grafeas and Kritis to govern container software across a platform handling more than 6,000 container builds per day and 330,000 images in its primary registry. Grafeas serves as a central store for metadata about container origins, builds, base images, layers, registry pulls, installed packages, vulnerabilities, and deployment status, supporting auditing and lifecycle strategies. During CI, audits produce attestations, which Shopify signs with PGP; Kritis uses named attestation authorities and Kubernetes policies to require specific attestations before deployment. Policies can require containers to be built by Shopify, sourced from a trusted repository, free of newly introduced vulnerabilities, tested, non-root, and deployed with the appropriate security context. Shopify also generates attestations from kubeaudit results for workload manifests, helping catch runtime-security regressions before deployment."
---

# How Shopify Governs Containers at Scale with Grafeas and Kritis

[Shopify](https://yomu.fyi/company/shopify) · Jonathan jonathan.pulsifer@shopify.com · Oct 12, 2017

**Type:** Explainer

## Summary

Shopify describes using Grafeas and Kritis to govern container software across a platform handling more than 6,000 container builds per day and 330,000 images in its primary registry. Grafeas serves as a central store for metadata about container origins, builds, base images, layers, registry pulls, installed packages, vulnerabilities, and deployment status, supporting auditing and lifecycle strategies. During CI, audits produce attestations, which Shopify signs with PGP; Kritis uses named attestation authorities and Kubernetes policies to require specific attestations before deployment. Policies can require containers to be built by Shopify, sourced from a trusted repository, free of newly introduced vulnerabilities, tested, non-root, and deployed with the appropriate security context. Shopify also generates attestations from kubeaudit results for workload manifests, helping catch runtime-security regressions before deployment.

## Context

Shopify’s security team needed an auditing strategy for more than 6,000 daily container builds and 330,000 images in its primary container registry. The stated questions included deployment status, registry pulls, installed packages, vulnerabilities, and compliance with security controls.

## Approach / What changed

Grafeas stores container metadata as a central source of truth. CI audits generate PGP-signed attestations, and Kritis applies Kubernetes policies that name required attestation authorities before permitting deployment. Shopify also uses kubeaudit results to attest to workload-manifest security controls during CI.

## Takeaways

- Grafeas centralizes metadata about container builds, origins, base images, layers, packages, vulnerabilities, pulls, and deployment status for auditing and lifecycle management.
- Kritis policies can require signed attestations from multiple named authorities, such as authorities confirming that a container was built by Shopify and passed testing.
- Shopify applies the same attestation model to kubeaudit results for Kubernetes workload manifests, checking runtime-security controls before deployment rather than after.

## FAQ

### How does Kritis decide whether a container can be deployed?

A Kritis policy names one or more attestation authorities whose attestations are required for a particular cluster. A container lacking the required signed attestations is precluded from deployment.

### Why does Shopify sign its attestations with PGP?

Shopify uses PGP to digitally sign attestations. This ensures the identity of the builder and other attestation authorities that issue them.

### Can the controls cover Kubernetes workload manifests as well as images?

Yes. Shopify generates Kritis attestations from kubeaudit results for workload manifests during CI, helping ensure runtime-security controls do not regress before deployment.

**Tags:** [Grafeas](https://yomu.fyi/topic/grafeas), [Kritis](https://yomu.fyi/topic/kritis), [Kubernetes](https://yomu.fyi/topic/kubernetes), [Security](https://yomu.fyi/topic/security)

- Source: [Shopify](https://shopify.engineering/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis)
- Source URL: https://shopify.engineering/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis
- Ingested by Yomu: 2026-09-17T14:13:10.889Z

[Read original post](https://shopify.engineering/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis)