SevyDevy

Design an artifact repository like jfrog

PremiumCloud infrastructureMedium

  • Remote proxy repositories
  • Content addressed storage
  • SHA 256 checksums

Quick answer

This cloud infrastructure interview question asks you to design an artifact repository like jfrog. Aim for a design that runs reliably and securely in the cloud at a sensible cost, then explain the services, regions, deployment and trade-offs. Interviewers want to see how you balance reliability, security and cost.

The problem

Design an artifact repository like JFrog Artifactory: one service where build systems publish and fetch packages such as Maven JARs, npm and PyPI packages, and where public packages are cached. The hard parts are serving thousands of CI jobs fast, keeping releases immutable and stopping malicious artifacts before they reach builds.

A company has 20,000 engineers and build farms in 3 regions. Each package format has its own client protocol and metadata files, but every file is just bytes with a checksum. Repositories come in three kinds: local (artifacts the company publishes), remote (a caching proxy for a public registry) and virtual (one URL that searches several repositories in order).

What must an artifact repository like jfrog do?

  • Publish and fetch: Clients publish and fetch artifacts with their native tools (Maven, npm, pip) using per-user or per-pipeline tokens.
  • Block malicious artifacts: Every new artifact, local or fetched from upstream, is scanned; artifacts found malicious are quarantined and cannot be downloaded.
4 more requirementsUnlock to see all

How well must it do it?

  • Availability: 99.95% for fetches; builds keep working when a public registry is down.
  • Fetch latency: Metadata under 100 ms at p99 within a region; artifact downloads limited only by the network.
2 more requirementsUnlock to see all

What scale should you design for?

Use these numbers in your estimates.

The scale numbers unlock with this questionUnlock

Key concepts

  • Remote proxy repositories
  • Content addressed storage
  • SHA 256 checksums
  • Malicious package quarantine
  • Build promotion
  • Dependency confusion

How you’ll practise

6 short steps · save and come back any time
  1. Requirements
  2. Environments and topology
  3. Deployment pipeline
  4. Reliability and disaster recovery
  5. Observability and cost
  6. Wrap-up

Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.

What do interviewers look for?

In any cloud infrastructure design round.

  • Clarifies availability, security and cost targets
  • Chooses managed services with reasons
  • Plans regions, zones and failover
  • Covers identity, secrets and network boundaries
  • Explains deployment, rollback and observability
  • Keeps an eye on cost as usage grows

Questions people ask about this interview question

Which design type is this question?
It is a cloud infrastructure question. You design an artifact repository like jfrog and explain your choices the way you would in an interview.
Is this question asked at entry level?
It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
What should I cover first?
Start with the workloads, the availability target and the security and cost limits. Agree on scope with the interviewer before you design anything.
Can I practise it for free?
It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.

Related questions

Updated · Written by the SevyDevy team

Premium questionSign up free, then unlock it