Katkat
Back

Design a container image registry

DockerSoftware Engineer · Technical Screen
MediumSoftware EngineerTechnical ScreenSystem Design

Last updated

This problem tests your ability to design a distributed, content-addressable storage system that handles large binary blobs and metadata while optimizing for read/write performance and storage efficiency.

Design a Container Image Registry

Design a service that allows users to push and pull container images. A container image is composed of a manifest (a JSON file describing the image layers) and multiple binary layers (tarballs).

Requirements

  • Functional:
    • Users can push images (manifest + layers).
    • Users can pull images by tag (e.g., my-app:latest) or digest (SHA-256 hash).
    • Support for deduplication: If two images share the same layer (same content), store that layer only once.
  • Non-Functional:
    • High availability for pulls (reads).
    • Ability to handle multi-gigabyte layers.
    • Consistent metadata management.
  • Scale:
    • Millions of images; petabytes of data.
    • High traffic volume during peak CI/CD build times.

Expectations

Provide a high-level architecture that includes:

  1. Data Model: How to represent images, layers, and tags.
  2. Storage Strategy: Where to store the binary blobs vs. metadata.
  3. API Design: Core endpoints for uploading and downloading content.
  4. Optimization: How to handle heavy concurrent reads and minimize cross-region data transfer.

Example Flow

  • Push: Client sends image layers -> Server stores blobs -> Client sends manifest -> Server links layers to the manifest.
  • Pull: Client requests repo:tag -> Server returns manifest -> Client requests specific layer hashes -> Server returns blob data.

Hints

Hint 1

Consider the difference between storing small metadata (the manifest) and large, immutable binary blobs.

Hint 2

Think about how content-addressable storage (using the SHA-256 hash as the key) simplifies deduplication across different repositories.

Hint 3

Address how you would handle partial uploads or interrupted connections for large multi-gigabyte files.

Follow-up questions

  • How would you implement a garbage collection process to safely delete layers that are no longer referenced by any manifest?
  • How would you integrate fine-grained access control (RBAC) to ensure only authorized users can push/pull specific repositories?
  • If we scale to global distribution, how would you design a caching or replication strategy to reduce latency for users in different continents?