Problem Statement: Enterprise Container Registry
How Problem Statement: Enterprise Container Registry (understanding) informs Container Registry architecture and interviewer depth.
Problem Statement: Enterprise Container Registry
Design a private OCI container registry that stores immutable images for thousands of microservices. Interviewers want separation of metadata plane (manifests, tags, ACLs, scan status) from blob plane (content-addressable layers in object storage). Anchor outcomes: p99 pull start < 800ms for warm layers in-region, 99.99% registry API availability, and policy-gated promotion so CVE-critical images never reach production clusters.
Interview Focus
- Separate metadata plane from blob plane and state durability assumptions
- Quantify deploy-wave pull fan-out before sizing API and CDN
- Layer tenancy: RBAC, quotas, rate limits, and audit trails
- Explain promotion gates: scan + signature before prod tag moves
How to open this one
The framing that signals depth on a container registry is separating the metadata plane (manifests, tags, ACLs, scan status) from the blob plane (content-addressable layers in object storage), because they scale and fail differently. Lead with content-addressing — identical layers stored once, pulls served warm from cache — and the failure story that matters: a CVE-critical image is requested for prod, and policy-gated promotion plus immutable digests stop it before it runs. That shows you understand a registry is a supply-chain control, not just storage.
Key Highlights
- •Pin prod deploys to immutable digests
- •Dedup layers in object storage by sha256
- •Async scan + policy before promotion
- •Replicate blobs per compute region
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "I'll anchor Problem Statement: Enterprise Container Registry to pull SLOs, tenant isolation, and measurable promotion gates."
- "If pressed, I'll compare managed registries versus Harbor only after stating ops cost."