OCI Standard — Why You Are Not Locked In

Two specs, one industry

The Open Container Initiative (OCI) is a Linux Foundation project that standardizes:

Image Specification — how container images are structured: manifest, config, layers, digests.
Runtime Specification — how a runtime should create and run a container from a bundle.

Both Docker and Podman build images that satisfy the Image Spec. Both Docker (via runc) and Kubernetes (via containerd) use Runtime-Spec-compliant runtimes. An image built once runs anywhere OCI is honored.

Anatomy of an OCI image

Manifest — JSON document listing the config and the layers (each by digest).
Config — runtime defaults: CMD, ENV, exposed ports, working directory, user.
Layers — gzipped tarballs of filesystem diffs. Stack them with OverlayFS to get the running filesystem.
Digests — SHA-256 hashes. Two images with the same layer digests share the layer on disk. Reproducibility is built in.

Why this matters operationally

You build with Docker on your laptop, push to GitHub Container Registry, and pull-and-run in Kubernetes (which uses containerd). Nothing in this chain requires Docker the company. The artifacts are portable because the spec is what everyone agreed on.

Code

Inspect an image's manifest·bash

# Pull and inspect the manifest of a public image
docker buildx imagetools inspect --raw nginx:1.27-alpine | head -30

# Returns a JSON manifest with mediaType, config (digest, size),
# and layers (each with digest + size).

# Layer digests are the deduplication key —
# any two images sharing a layer share one copy on disk.

OCI Standard — Why You Are Not Locked In

Two specs, one industry

Anatomy of an OCI image

Why this matters operationally

Code

External links

Exercise

Progress

Comments 0