Design a Container Image Security Scanner

Last updated: December 9, 2025

Quick Overview

Design a system that scans container images for vulnerabilities, malware, misconfigurations, and secrets across container registries in multi-cloud environments.

Wiz
System Design
Software Engineer
Wiz
December 9, 2025
Software Engineer
Technical Phone Screen
System Design
Medium

7

9

2,893 solved


Design a system that scans container images for vulnerabilities, malware, misconfigurations, and secrets across container registries in multi-cloud environments.

Container security is increasingly critical as organizations adopt Kubernetes. The scanner must analyze container image layers for known CVEs, embedded secrets, malware signatures, and Dockerfile misconfigurations. It should integrate with the Security Graph to show how container vulnerabilities connect to running workloads.

What the Interviewer Expects
  • Design an efficient layer-by-layer scanning approach for container images
  • Integrate vulnerability databases (NVD, vendor advisories) for CVE matching
  • Handle scanning images from multiple registries (ECR, ACR, GCR, Docker Hub)
  • Connect findings to the Security Graph for runtime context
Key Topics to Cover
Container image layer analysis
CVE database integration
Multi-registry support
Deduplication via layer hashing
Security Graph integration
How to Approach This
  1. Start by clarifying functional and non-functional requirements with the interviewer.
  2. Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
  3. Draw a high-level architecture first, then deep dive into 1-2 critical components.
  4. Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
  5. Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
  • How would you optimize scanning when many images share common base layers?
  • How do you handle scanning private registries with different authentication methods?
  • How would you prioritize which images to scan when there's a backlog?
Sharpen Your Skills on Codemia

Practice similar problems with our interactive workspace, get AI feedback, and track your progress.

Practice System Design Problems
Sample Answer
Layer-Based Scanning

Container images are composed of layers. Hash each layer and cache scan results by layer hash. If a base layer (e.g., ubuntu:22.04) appears in 1000 im...

Vulnerability Matching

Maintain a continuously updated vulnerability database aggregating NVD, vendor security advisories, and distro-specific trackers. Match installed pack...


Submit Your Answer
Markdown supported

Related Questions