Stage 4 · Provision
Production Containers
OCI Spec
Understand OCI image layout, runtime spec, manifests, layers, config JSON, and media types.
What Is the OCI?
The Open Container Initiative (OCI) is a governance structure under the Linux Foundation that defines industry standards for container formats and runtimes. The OCI specification has two parts: the Image Specification (how images are structured) and the Runtime Specification (how containers are executed).
| Specification | Defines | Used By |
|---|---|---|
| Image Spec | Image format, layers, manifests | Docker, containerd, Podman |
| Runtime Spec | Container execution, config | runc, crun, youki |
| Distribution Spec | Registry API | Docker Hub, GHCR, ECR |
Image Spec
An OCI image is a collection of content-addressable layers referenced by a manifest. Each layer is a tar archive with filesystem changes. The manifest lists all layers and references the image configuration. The image config specifies the entrypoint, environment, working directory, and other metadata.
# Pull an image and inspect its layers
docker inspect nginx:alpine --format '{{json .RootFS.Layers}}' | jq
# Example output:
# [
# "sha256:abc123...", # Base Alpine filesystem
# "sha256:def456...", # nginx package installation
# "sha256:ghi789...", # nginx configuration
# ]
# Each layer is a content-addressable blob
docker save nginx:alpine | tar -xf - manifest.jsonEvery layer is identified by its SHA256 hash. If the content changes, the hash changes. This makes images tamper-evident — modifying a layer changes its hash, which breaks the chain of trust.
Runtime Spec
The OCI Runtime Specification defines how to run a container. It specifies the config.json file that describes the container's root filesystem, namespaces, cgroups, capabilities, mounts, and hooks. runc is the reference implementation.
# The OCI runtime config.json is generated by containerd
# It specifies container isolation and resource limits
{
"ociVersion": "1.0.0",
"process": {
"user": { "uid": 1000, "gid": 1000 },
"args": ["node", "server.js"],
"env": ["NODE_ENV=production"],
"cwd": "/app"
},
"root": {
"path": "rootfs",
"readonly": true
},
"linux": {
"namespaces": [
{ "type": "pid" },
{ "type": "network" },
{ "type": "mount" }
],
"resources": {
"memory": { "limit": 536870912 },
"cpu": { "quota": 200000 }
}
}
}This config.json tells runc how to create the container: which namespaces to create, resource limits to enforce, and the entrypoint to execute. It is the bridge between image and runtime.
Image Manifest
{
"schemaVersion": 2,
"mediaType": "application/vnd.oci.image.manifest.v1+json",
"config": {
"mediaType": "application/vnd.oci.image.config.v1+json",
"digest": "sha256:abc123...",
"size": 582
},
"layers": [
{
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
"digest": "sha256:def456...",
"size": 3245678
}
]
}The manifest is the root object of an image. It references the config (metadata) and layers (filesystem changes). Each reference includes a media type, digest, and size.
Image Config
{
"architecture": "amd64",
"os": "linux",
"config": {
"Cmd": ["node", "server.js"],
"Env": ["NODE_ENV=production", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"],
"WorkingDir": "/app",
"User": "1000"
},
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:base123...",
"sha256:layer456..."
]
}
}The config contains the image's architecture, OS, entrypoint, environment, and working directory. The diff_ids are uncompressed layer digests, while the manifest references compressed digests.
Media Types
| Media Type | Description |
|---|---|
| application/vnd.oci.image.manifest.v1+json | Image manifest |
| application/vnd.oci.image.config.v1+json | Image configuration |
| application/vnd.oci.image.layer.v1.tar+gzip | Compressed layer |
| application/vnd.oci.image.layer.v1.tar | Uncompressed layer |
| application/vnd.oci.image.index.v1+json | Manifest list (multi-arch) |
crane is a tool for interacting with container registries at the OCI level: crane manifest nginx:alpine, crane config nginx:alpine, crane blob nginx:alpine sha256:abc....
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.