Problem Statement
Design a Remote Browser Isolation (RBI) system for enterprise customers. The system should allow employees to browse the internet safely by rendering web content on remote servers and streaming only the visual output to the user's device.
No actual web content (HTML, JS, CSS) should reach the user's endpoint.
Requirements
Functional:
- Users open a browser that connects to a remote rendering engine
- Web pages are fetched and rendered on the server side
- Only pixel streams (or draw commands) are sent to the client
- Users can interact with the page (click, scroll, type) with minimal latency
- Support enterprise-scale (10K+ concurrent users)
Non-Functional:
- Latency < 100ms for interactions
- Support HD video streaming on pages
- Zero-trust security model
- Multi-tenant isolation between enterprise customers
Discussion Points
You should cover:
- Architecture — How do you isolate each browsing session? (containers, VMs, virtual nodes)
- Authentication & Authorization — SSO integration, RBAC, session tokens
- Data streaming — Protocol choice (WebRTC, WebSocket, proprietary). Pixel streaming vs DOM mirroring trade-offs.
- Edge servers & CDN — How to minimize latency for globally distributed users
- Rate limiting & abuse prevention — Per-user, per-org throttling
- Gateway design — How requests are routed from client to the correct isolated session
- Scaling — How to handle burst traffic (auto-scaling virtual nodes)
- Security boundaries — Network segmentation, preventing lateral movement, data exfiltration prevention
Follow-ups
- How would you handle clipboard copy/paste between the isolated browser and the user's local machine securely?
- What happens when a user needs to download a file from the isolated session?
- How do you handle WebRTC/WebSocket connections initiated by the remote page?
- What's your approach to caching — can two users share a rendered page?