How the interviewer opens it
“Design a registry where developers publish and download software packages and container images. It must support immutable artifacts, access controls, and users across the world.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Clients and artifact types
- Scale and operation mix
- Artifact sizes
- Versions, digests, and tags
- Access controls
- Latency
- Consistency and availability
- Durability and retention
- Interrupted operations
- Scope limits
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Publish immutable package versions and container image manifests
- Download artifacts by version or digest
- Control repository access for users and teams
- Serve global downloads and resume interrupted transfers
Usually out of scope
- Resolve package dependencies or execute software
- Scan artifacts for malware
- Support every package client protocol
- Accept concurrent writes in multiple regions
What interviewers ask about
- Publication and version names
- A publication spans large byte transfers and small catalog writes. A visible manifest must never refer to absent bytes.
- Downloads across regions
- Byte volume dominates request volume. A popular release can overload the origin before edge caches contain its layers.
- Access to private artifacts
- Long-lived cached bytes must remain private. Permission changes must affect new requests without removing every cached copy.
Common mistakes
- The design sends every download through the catalog servers.
- The design treats a known digest as permission to read private bytes.
- The catalog exposes manifests before all referenced bytes are durable.
- The design changes bytes under an existing version or digest.
- The design counts requests but ignores byte transfer and cold cache traffic.
- The design promises prompt revocation while it accepts download grants that last for hours.
The bar by level
- Senior (L5/E5)
- Explains concurrent publication and retries after uncertain results. Validates complete manifests before visibility. Handles resumable transfers, tag changes, and private cache hits within the revocation limit.
- Staff (L6+/E6+)
- Sets explicit failure boundaries across storage, catalog, edges, and authorization. Budgets cold origin traffic and cumulative revocation delay. Explains safe storage reuse and regional outage behavior. Avoids extra distributed components until a requirement needs them.
Sources · 1 reference
These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.
SysRound · 1 record
No company association
Design an artifact registry like Artifactory
Reported date not specified
Source snapshot: Nov 12, 2026
View source