Design Artifact Repository

Problem Statement: Enterprise Artifact Repository

Design a universal artifact repository (JFrog Artifactory / Sonatype Nexus / GitHub Packages class) that stores immutable build outputs across Maven, npm, PyPI, Docker/OCI, Helm, and generic binaries. Interviewers expect a metadata control plane (repos, permissions, indexes, promotion state) separate from a content-addressable blob plane (deduplicated storage). Anchor SLOs: p99 resolve start < 400ms for warm cache hits in-region, 99.99% API availability, and policy-gated promotion so un-scanned or unsigned artifacts never reach production-facing repos.

Interview Focus

• Separate metadata plane from blob plane; state durability per ecosystem
• Quantify publish vs resolve QPS and deploy-wave pull fan-out before sizing
• Immutable coordinates (GAV, npm scope, OCI digest) with promotion gates
• Proxy/virtual repos, replication lag budgets, and GC legal-hold paths

How to open this one

The framing that signals depth on an artifact repository is content-addressed, immutable storage with a metadata plane separate from the blob plane: artifacts are addressed by digest, deduplicated and stored once, and promoted by reference rather than overwritten. Lead with retention/GC that never deletes a referenced artifact and the failure story that proves it: a mutable 'latest' tag is overwritten and a rollback can no longer find the bytes it needs. That shows you understand a repository is the supply-chain source of truth, not a file share.