OCI Specification

Defines the content-addressable structure of container images as a Merkle tree of descriptors. An image consists of:

• Manifest: JSON document referencing a config blob and ordered layer blobs
• Config: Execution parameters including environment variables, entrypoint, and architecture
• Layers: Gzipped tar archives representing filesystem changes applied in sequence

Each component is identified by a SHA256 digest, enabling cryptographic integrity verification and deduplication across registries.

Standardizes the HTTP API for pushing and pulling content to and from registries. Key endpoints include:

• PUT /v2/<name>/manifests/<ref>: Upload a manifest
• GET /v2/<name>/blobs/<digest>: Fetch a layer by content hash
• HEAD requests: Check existence without downloading

This API enables cross-registry interoperability, allowing tools like Skopeo to copy images between any OCI-compliant registry without vendor lock-in.

Defines how to unpack and execute an OCI image on a host system. Specifies:

• Filesystem bundle layout: How layers are merged into a rootfs directory
• config.json: JSON document defining process isolation, cgroups, namespaces, seccomp profiles, and mount points
• Lifecycle hooks: Pre-start, post-start, and post-stop operations

This ensures that any OCI-compliant runtime—such as runc, crun, or gVisor—can execute the same image identically.

Extends registries beyond container images to store arbitrary artifact types. Uses the OCI Artifact Manifest to reference any content type:

• Helm charts stored as OCI artifacts
• SBOMs and vulnerability scan results attached to images
• Cosign signatures and Sigstore attestations

Artifacts are referenced via the referrers API, enabling discovery of all supplementary metadata associated with a given image digest without modifying the original manifest.

Every blob and manifest is addressed by its cryptographic digest rather than a mutable tag. This provides:

• Tamper detection: Any modification changes the digest
• Deduplication: Identical layers are stored once across all images
• Deterministic pulls: The same digest always yields identical content

Tags remain as mutable pointers to digests, but production deployments should reference digests directly for immutable, verifiable deployments.

The OCI Image Index (or Docker Manifest List) allows a single tag to reference multiple platform-specific manifests. An index contains:

• Array of descriptors with platform fields (os, architecture, variant)
• Each descriptor points to a full image manifest for that platform

Runtimes automatically select the matching manifest for their architecture, enabling a single nginx:latest tag to serve amd64, arm64, s390x, and other architectures transparently.

An OCI Image Index (or Docker manifest list) that references multiple platform-specific image manifests under a single tag. Each entry specifies the platform.os and platform.architecture (e.g., linux/amd64, linux/arm64). When a runtime pulls the tag, it automatically selects the manifest matching its architecture. This enables seamless cross-platform deployment without manual architecture selection.