The attack in Boulder ended with an injured, shirtless suspect being led away from the King Soopers market.
The shooting was live-streamed by witnesses and broadcast on YouTube.
The incident began around 14:30 local time (20:30 GMT) when the suspect entered the grocery store and began firing.
The Boulder police tweeted some 20 minutes later that there was an "Active Shooter at the King Soopers on Table Mesa" street.
Two hours later, the police again warned people to avoid the area. "Do NOT broadcast on social media any tactical information you might see," the tweet added.
However, some of the stand-off was captured on camera by a passer-by showing victims near the grocery store.
"I don't know what's going on... I heard gun shots, someone's down," the cameraman shouts. "There's an active shooter, get away".
Gun shots can be heard as he runs away from the shop.
The video continues, with police arriving on the scene and surrounding the market.
On Twitter, Colorado governor Jared Polis said: "My prayers are with our fellow Coloradans in this time of sadness and grief as we learn more about the extent of the tragedy."
President Joe Biden has been briefed about the shooting, the White House said.