# How Shopify Governs Containers at Scale with Grafeas and Kritis

DevFeed: [How Shopify Governs Containers at Scale with Grafeas and Kritis](<https://devfeed.tech/articles/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis-1415.md>)

Original publisher: [Read original article](<https://shopify.engineering/how-shopify-governs-containers-at-scale-with-grafeas-and-kritis>)

Author: Jonathan jonathan pulsifer com

Published: 2017-10-12T15:02:00Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [Shopify](<https://devfeed.tech/topics/shopify.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Google](<https://devfeed.tech/topics/google.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [attestation](<https://devfeed.tech/tags/attestation.md>), [audits](<https://devfeed.tech/tags/audits.md>), [ci](<https://devfeed.tech/tags/ci.md>), [container-registry](<https://devfeed.tech/tags/container-registry.md>), [containers](<https://devfeed.tech/tags/containers.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [google](<https://devfeed.tech/tags/google.md>), [identity](<https://devfeed.tech/tags/identity.md>), [images](<https://devfeed.tech/tags/images.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [operations](<https://devfeed.tech/tags/operations.md>), [packages](<https://devfeed.tech/tags/packages.md>), [pipelines](<https://devfeed.tech/tags/pipelines.md>), [policy](<https://devfeed.tech/tags/policy.md>), [production](<https://devfeed.tech/tags/production.md>), [registry](<https://devfeed.tech/tags/registry.md>), [security](<https://devfeed.tech/tags/security.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>)

## AI overview

Shopify describes using Google's open source Grafeas to centralize metadata about container builds, images, packages, origins, deployments, and vulnerabilities. It also uses Kritis with Kubernetes to enforce real-time deployment policies based on signed attestations generated during CI.

## Source excerpt

Today, Google and its contributors launched Grafeas, an open source initiative to define a uniform way for auditing and governing the modern software supply chain. At Shopify, we're excited to be part of this announcement. Grafeas, or "scribe" in Greek, enables us to store critical software component metadata during our build and integration pipelines.