Content-addressable blob storage

Design a content-addressable storage system (CAS) that backs a container-image registry and an artifact/package store. Constraints: blobs keyed by their cryptographic digest, heavy sharing of base layers across images, immutable blobs but mutable tags pointing at them, billions of small-to-medium blobs, and aggressive caching is safe because content can't change under a digest. Cover the addressing model, the tag/manifest layer, and GC.