TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

Container Security and Governance

3 posts · Oct 2014 – Nov 2020

What this trail covers

Shopify has evolved its container security and governance practices by implementing Binary Authorization for Kubernetes, leveraging Voucher for signing Docker images after security checks. This builds upon previous efforts to manage application secrets in containerized environments and the overall containerization strategy, moving away from less secure methods and towards automated, verifiable image deployment. Voucher has been integrated into the Grafeas project. This post details the initial steps in containerizing applications using Docker and CoreOS, focusing on portability, predictability, density, consistency, and developer/ops workflows.

All Shopify trails
  1. Vouching for Docker Images - ShopifyThis post introduces Binary Authorization for Kubernetes and explains how Shopify uses Voucher, an open-source signing service, to sign Docker images after security checks. It details the concepts of code signing, hashing, public/private keys, and how Binary Authorization, Grafeas, and Kritis work together. Voucher's role as the signing service is highlighted, including its ability to perform custom security checks and integrate with GitHub approvals. The post also announces Voucher's move into the Grafeas project.
  2. How Shopify Governs Containers at Scale with Grafeas and Kritis - ShopifyThis post details Shopify's adoption of Grafeas for storing container metadata and Kritis for enforcing deployment policies on Kubernetes. It highlights how Grafeas enables auditing of container origins, package contents, and security vulnerabilities, while Kritis uses signed attestations from authorities (e.g., 'built-by-us', 'tested') to enforce deployment policies, preventing the deployment of non-compliant containers. The post also mentions generating attestations for Kubernetes workload manifests using kubeaudit.
  3. Docker at Shopify: How We Built Containers that Power Over 100,000 Online Shops - ShopifyThis post details the creation of Shopify's production Docker base image, advocating for 'thin' containers and the '100 rule' for shared services. It outlines environment setup by transliterating Chef recipes into Dockerfiles, discusses containerizing applications with specific conventions for code layout and Git repos, and emphasizes the 'compile' phase for producing ready-to-run containers. It also touches on debugging techniques and the use of `docker exec`.
  4. Building an Internal Cloud with Docker and CoreOS - ShopifyThis post introduces the initial steps in containerizing applications using Docker and CoreOS. It details the benefits of Docker for portability, predictability, density, consistency, and developer/ops workflows. It also outlines future installments covering containerizing existing applications, managing secrets, routing, monitoring, bulletproofing, and provisioning.