Skip to content

What is PerfShop

PerfShop is a pedagogical chaos engineering platform that materializes, on a realistic e-commerce application, every type of anomaly that a testing or performance professional encounters during their career. The goal is not to learn how to build a shop — it is to provide instructors and students with a training ground in which they can trigger incidents, diagnose them, observe them and resolve them.

The concept in one sentence

A classic e-commerce shop on which an instructor can, in one click, trigger a memory leak, a SQL injection, a silent VAT rounding, a MySQL deadlock or an OWASP privilege escalation — and watch their students identify them in Grafana, Loki, Tempo and Pyroscope.

What PerfShop is not

  • It is not a real e-commerce site. It has no commercial purpose — it is a realistic but entirely local simulation, disconnected from any real payment circuit.
  • It is not a lab manual. This documentation describes the platform and its components; the hands-on exercises themselves are sold separately with the commercial license and hosted on a dedicated portal.
  • It is not a black box. The code is open under AGPL-3.0-or-later license and this documentation is designed so that anyone can understand and modify the platform.
  • It is not a production tool. The "flaws" injected by PerfShop are deliberate and activated on demand. On a real merchant application, they would be serious bugs to fix.

What PerfShop is

  • A pedagogical bible — every type of incident a testing or performance engineer can encounter (CPU burn, OOM, SQLi, race condition, timing attack, exception cascade, silent business anomalies, etc.) is reproduced in a controlled, isolable and observable way.
  • A complete ecosystem — Spring Boot 3.2 backend + React 18 frontend + MySQL 8 database + Prometheus/Grafana/Loki/Tempo/Pyroscope/OpenSearch observability + complete QA stack (Selenium, Squash TM, JMeter, polyglot test runner, Forgejo).
  • A real, ready-to-use platform — a single docker compose up is enough to start the entire stack, with no manual installation of any component.
  • A modular training medium — the instructor chooses which chaos types to activate, at what level (0-4), according to the desired pedagogical progression.

The seven chaos families

PerfShop groups its anomalies into seven families covering the entire spectrum of issues encountered in a modern web application:

Family Coverage Example incident
Performance CPU, memory, GC, DB connection pool, threads, slow queries, deadlocks, network Progressive OutOfMemoryError on the JVM
Scripting HTTP correlation, rolling tokens, HMAC signatures, expirations CSRF token regenerated at every checkout step
Frontend Browser CPU burn, JS memory leak, DOM flood, fetch flood UI freeze caused by a Web Worker computing in a loop
Business VAT, rounding, stock, promo, loyalty, currency, shipping fees VAT 19.6% instead of 20% — silent anomaly
Functional Real Java exceptions NullPointerException in processPaymentPublic()
Security OWASP Top 10 SQLi on /api/products/search
Pedagogical Multi-level escape-room journey 100 enigmas across BAC1-BAC5

Each family is documented in detail in its dedicated section. See Chaos Engineering for the overview.

The pedagogical journey

In addition to the technical chaos families, PerfShop includes an escape-room journey of 100 enigmas spread over five levels (BAC1 to BAC5). The student plays an agent who must explore the catalog, identify products, solve mathematical and cryptographic enigmas, find passwords, and validate their progression step by step. The full journey lasts several hours and can serve as an evaluation, a hackathon or a course material.

See Concept and architecture of the pedagogical journey.

Pedagogical philosophy

Three principles guide the design of PerfShop:

1. The code must always be functional with no chaos active

When all chaos families are at zero, PerfShop is a perfectly healthy e-commerce application. The business rules are correct, the security flaws are absent, performance is nominal. This is the reference state that we always come back to between two exercises.

This rule has an important consequence: the "clean" code and the "corrupted" code coexist in the same repository, separated by flags controlled by the BusinessChaosService, SecurityChaosService and similar services. The instructor activates whatever they want without ever touching the source code.

2. Incidents must be observable

Any activated chaos must be visible in at least one observability tool: Prometheus metrics, Loki logs, Tempo traces, Pyroscope profiles, or the real-time HTML monitoring. The student must have a chance to diagnose for themselves what is happening.

The only exceptions are the deliberately silent chaos types — Functional Master level (F4: data corruption with no exception, HTTP 200, green tracing), Business Master (anomalies A12-A16 invisible except by JSON inspection). These special cases are pedagogically interesting: they teach students that a green monitoring screen does not guarantee correct behavior.

3. The platform must be controlled by the instructor

The instructor has a unified panel (chaos-admin) that allows them to activate or deactivate any chaos in one click. Students have access to a limited version of the panel (the student page) that lets them experiment in a sandbox, but the instructor always keeps control via a "student mode" toggle that can lock all student commands.

See Chaos admin (instructor) and Student chaos page.

Background

PerfShop is designed and developed by Philippe Naveau, performance testing consultant at Sogeti/Capgemini France. The project was born from a simple observation: testing and performance engineers learn their trades on the job, through production incidents, with no safe training ground where they can trigger bugs and observe their effects. Existing training courses explain the concepts (cache miss, memory leak, SQL injection, etc.) but never put the trainee in a position to see one for real.

PerfShop fills this gap by offering a realistic application in which the instructor can trigger on demand every known type of incident. Each chaos is carefully dosed to avoid overflowing — a memory leak can be capped at 80% of heap without crashing the JVM, a CPU burn can be tuned to the exact percentage, a SQLi is contained inside the search feature without affecting the rest of the database.

The project combines its author's field experience (LoadRunner / JMeter / Tempo / Grafana / OpenTelemetry) with a strong pedagogical objective.

License

PerfShop is published under a dual license: AGPL-3.0-or-later for open source use, and a commercial license for use cases that cannot satisfy the AGPL obligations (training sold to third parties, integration into a proprietary product, etc.).

See License for the summary, and License system for the technical details.

Contact

See also