Design a Container Image Security Scanner
Last updated: December 9, 2025
Quick Overview
Design a system that scans container images for vulnerabilities, malware, misconfigurations, and secrets across container registries in multi-cloud environments.
Wiz
December 9, 20257
9
2,893 solved
Design a system that scans container images for vulnerabilities, malware, misconfigurations, and secrets across container registries in multi-cloud environments.
Container security is increasingly critical as organizations adopt Kubernetes. The scanner must analyze container image layers for known CVEs, embedded secrets, malware signatures, and Dockerfile misconfigurations. It should integrate with the Security Graph to show how container vulnerabilities connect to running workloads.
What the Interviewer Expects
- Design an efficient layer-by-layer scanning approach for container images
- Integrate vulnerability databases (NVD, vendor advisories) for CVE matching
- Handle scanning images from multiple registries (ECR, ACR, GCR, Docker Hub)
- Connect findings to the Security Graph for runtime context
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How would you optimize scanning when many images share common base layers?
- How do you handle scanning private registries with different authentication methods?
- How would you prioritize which images to scan when there's a backlog?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
- Functional Requirements:
- Scan container images for vulnerabilities (CVE), malware, misconfigurations, and secrets.
- Support for multiple container registries (AWS ECR, Azure ACR, Google G...
Capacity Estimation
To estimate capacity, we consider the following:
- Daily Scans: If we expect to handle 10,000 scans per day, that's approximately 416 scans per hour or about 7 scans per minute.
- Image Size: ...
Submit Your Answer
