# Design a container image vulnerability scanner: system design interview question

> Shared image layers and new vulnerability data require correct software inventories, reusable analysis, and current reports.

Source: https://sysround.com/questions/design-container-image-vulnerability-scanner
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a service that finds known vulnerabilities in container images. Users submit images and expect results to remain current as vulnerability information changes."

## What to clarify first

- Image submission and access
- Supported software
- Retained scale
- Request volume
- Image layers
- Latency
- Vulnerability data
- Consistency and availability
- Durability and tenant access
- Scope limits

## Scope of a strong answer

Core requirements:

- Scan a container image and report its software dependencies and known vulnerabilities
- Reuse analysis across shared image layers
- Report known fixed versions for affected packages
- Reassess retained images when vulnerability data changes

Usually out of scope:

- Analyze application source code
- Run images to detect malicious behavior
- Discover unknown vulnerabilities
- Support multiple CPU architectures
- Build the external vulnerability data sources

## What interviewers probe

### Software across image layers

Layers describe filesystem changes, not independent package lists. Later layers can remove or replace software that earlier layers contain.

### Changes to vulnerability data

One advisory can affect millions of images. Repeated updates can race with scans and leave reports incomplete or older than their predecessors.

### Image identity and shared work

Many images share the same bytes. Worker failures and analyzer changes can make shared results incomplete, obsolete, or unsafe to publish.

### Images from unknown sources

The service parses attacker-controlled archives and metadata. A small image can consume excessive resources or attempt access beyond its permitted files.

## Common mistakes

- The design treats an image as an unordered union of packages from its layers.
- The design uses a mutable tag as the identity for reusable analysis.
- The service downloads every image whenever vulnerability data changes.
- The matcher ignores distribution fixes and ecosystem version rules.
- The service presents an incomplete or outdated report as a current clean result.
- The service trusts image contents or a known digest without resource limits and tenant access checks.

## The bar by level

- **Senior:** The candidate separates layer evidence, final inventories, and vulnerability assessments. The candidate handles shared work, feed changes, withdrawals, retries, tenant access, and unsafe archives.
- **Staff+:** The candidate closes races between inventory publication and feed updates. The candidate plans selective reassessment at fleet scale. The candidate defines analyzer upgrade, freshness, isolation, and recovery guarantees.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=container-vulnerability-scanning


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.