---
title: "Grafeas"
description: "2 posts about Grafeas, summarised, each linking to the original."
---

# Grafeas
> 2 posts about Grafeas, summarised, each linking to the original.

## Articles

### [Shopify’s Infrastructure Collaboration with Google](https://yomu.fyi/post/shopify-s-infrastructure-collaboration-with-google.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Dale Neufeld
- Published: Mar 26, 2018
- Type: Announcement

Shopify announces that it is building its Cloud with Google after more than a decade of operating the foundation of its commerce cloud through its own data centers and incremental public-cloud adoption. Its infrastructure evolved from database and application sharding, performance testing, automated failovers, and Docker-based immutable infrastructure toward Kubernetes orchestration, after the company initially built minimal container-management features itself. During the migration, Shopify created Shop Mover, a selective database migration tool that rebalances shops between shards with an average of 2.5s downtime per shop, and moved more than 50% of data-center workloads to Google Cloud. It also grew to more than 400 production services, consolidated them on Kubernetes through a platform-as-a-service, and contributed to and used Grafeas for software supply-chain auditing and governance.


### [How Shopify Governs Containers at Scale with Grafeas and Kritis](https://yomu.fyi/post/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Jonathan jonathan.pulsifer@shopify.com
- Published: Oct 12, 2017
- Type: Explainer

Shopify describes using Grafeas and Kritis to govern container software across a platform handling more than 6,000 container builds per day and 330,000 images in its primary registry. Grafeas serves as a central store for metadata about container origins, builds, base images, layers, registry pulls, installed packages, vulnerabilities, and deployment status, supporting auditing and lifecycle strategies. During CI, audits produce attestations, which Shopify signs with PGP; Kritis uses named attestation authorities and Kubernetes policies to require specific attestations before deployment. Policies can require containers to be built by Shopify, sourced from a trusted repository, free of newly introduced vulnerabilities, tested, non-root, and deployed with the appropriate security context. Shopify also generates attestations from kubeaudit results for workload manifests, helping catch runtime-security regressions before deployment.