Design Container Security - System Design | WinJob

Container Security Context and Defense-in-Depth Goals

A production container security platform (CNAPP-style) protects workloads across the lifecycle: build (image scan, SBOM, signing), ship (registry gates, admission control), and run (runtime threat detection, KSPM). Companies like Aqua, Snyk Container, and Twistlock/Palo Alto Prisma normalize layer-level CVEs, enforce digest-only deploys, and correlate build findings with runtime anomalies.

Problem framing

Scan every OCI image layer against NVD/GitHub advisory feeds; dedupe by package@version
Block deploy when CRITICAL CVE is exploitable in the running context (not just present in an unused layer)
Admission + runtime: only signed digests from trusted registries; detect shell spawn, crypto-mining, drift
Target SLO: p95 image scan < 3 minutes for 2GB images; admission webhook < 50ms p99

Design choices

Scanner workers pull manifests, explode layers, match OS packages (dpkg/rpm/apk) and language deps
Findings service stores CVE, CVSS, EPSS, fix version, layer index, and image digest lineage
Policy engine evaluates rego/Kyverno on scan results + SBOM + signature before kube admit
Runtime sensor (Falco/eBPF) streams syscalls to correlate with build-time inventory

Deep dive

For section 1, explain how layer caching avoids rescanning unchanged base layers, how distroless shrinks attack surface, and when agentless registry polling beats in-cluster DaemonSets. Cover Cosign/Sigstore, SLSA provenance, and CIS Docker/K8s benchmarks for compliance evidence.

javaOne Dark Pro

1 public final class LayerGate {
2   public boolean allowDeploy(String severity, boolean hasFix, boolean waived) {
3     if ("CRITICAL".equals(severity) && hasFix && !waived) return false;
4     return true;
5   }
6 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass
4 class LayerFinding:
5     cve_id: str
6     severity: str
7     layer_index: int
8     package: str
9  
10 def block_digest(findings: list[LayerFinding], block: set[str]) -> bool:
11     return any(f.severity in block for f in findings)

typescriptOne Dark Pro

1 interface ImageScanSummary {
2   digest: string;
3   criticalCount: number;
4   unsigned: boolean;
5 }
6  
7 export function admissionReject(summary: ImageScanSummary): boolean {
8   return summary.unsigned || summary.criticalCount > 0;
9 }

Interviewer positioning

Anchor on mean time to patch base images, percent workloads on pinned digests, and runtime incidents matched to CVE inventory. Reference how Aqua/Twistlock unify build and runtime graphs for faster RCA.

How to open this one

The framing that signals depth on container security is defense-in-depth across build, registry, and runtime: scan and sign images at build, gate promotion on policy, and constrain the runtime (non-root, read-only filesystem, seccomp/AppArmor, least-privilege RBAC). Lead with admission control that refuses an unsigned or vulnerable image, and the failure story that proves it: a compromised container escalates because it ran privileged with a writable filesystem and a permissive service account. That shows you understand container security is layered controls, not a single scanner.

Key Highlights

•Layer-level CVE mapping with digest-pinned deploys
•Admission gates on scan + SBOM + signature
•Runtime eBPF/Falco correlated to image inventory

1	public final class LayerGate {
2	public boolean allowDeploy(String severity, boolean hasFix, boolean waived) {
3	if ("CRITICAL".equals(severity) && hasFix && !waived) return false;
4	return true;
5	}
6	}

1	from dataclasses import dataclass
2
3	@dataclass
4	class LayerFinding:
5	cve_id: str
6	severity: str
7	layer_index: int
8	package: str
9
10	def block_digest(findings: list[LayerFinding], block: set[str]) -> bool:
11	return any(f.severity in block for f in findings)

1	interface ImageScanSummary {
2	digest: string;
3	criticalCount: number;
4	unsigned: boolean;
5	}
6
7	export function admissionReject(summary: ImageScanSummary): boolean {
8	return summary.unsigned \|\| summary.criticalCount > 0;
9	}