OCI Image Specification

The OCI Image Specification is the reason a container built with one tool runs under a completely different runtime. It defines the manifest that lists an image’s parts, the configuration that describes how to run it, the layer format, and the content-addressable descriptors that bind the whole thing together by digest rather than by name.

• Manifest and index - A JSON document listing config and layers, and a multi-platform index above it.
• Image configuration - Entrypoint, environment, user and the ordered layer digests that make up the root filesystem.
• Content addressing - Everything is referenced by digest, which is what makes an image verifiable rather than merely named.
• JSON Schema - The format is machine-checkable, and widely checked in practice.

For API teams this is the packaging half of the contract. The OpenAPI document says what the service promises; the image manifest says exactly what is running when it makes that promise, down to a digest you can compare. That link is what makes supply-chain attestation possible at all — in-toto, SLSA, Sigstore and the Notary Project all ultimately point at an image digest defined here. Companion specifications: OCI Runtime and OCI Distribution.