OCI Image

oci_image.md

skopeo copy docker://sameo/container101:latest oci:container101

Image layout

The OCI image layout in the host filesystem is specified here.

• oci-layout
• index.json is the image index.
• blobs directory contains all the image blobs: layers, manifests, etc.

$ ls -lt container101/
total 8
-rw-r--r--. 1 samuel samuel 187 Oct 19 11:02 index.json
-rw-r--r--. 1 samuel samuel  31 Oct 19 11:02 oci-layout
drwxr-xr-x. 1 samuel samuel  12 Oct 19 11:02 blobs

oci-layout

Describes the version of the OCI image layout used by this image.

$ cat oci-layout | jq
{
  "imageLayoutVersion": "1.0.0"
}

Image index (index.json)

The image index. is the top level image descriptor object. It can actually describe several images, for example to support multi architecture images.

It contains at least one decriptor (manifest, index, etc) and typically contains only one manifest descriptor.

$ cat index.json | jq
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "digest": "sha256:b90de38e7f52b3184d6f4093c302e2cebe2507a567a2dd83f3089bafd470ded9",
      "size": 1276
    }
  ]
}

Image manifest

An image manifest is a blob, usually referenced by the image index.

The image manifest references the image configuration and the image layers, all of them being blobs:

$ cat blobs/sha256/b90de38e7f52b3184d6f4093c302e2cebe2507a567a2dd83f3089bafd470ded9 | jq
{
  "schemaVersion": 2,
  "config": {
    "mediaType": "application/vnd.oci.image.config.v1+json",
    "digest": "sha256:a3f67696fbb48630ab71925a3df15b72d250b2102462014b9c50e6a553fd367e",
    "size": 3142
  },
  "layers": [
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:54ee1f796a1e650627269605cb8e6a596b77b324e6f0a1e4443dc41def0e58a6",
      "size": 28558017
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:f7bfea53ad120b47cea5488f0b8331e737a97b33003517b0bd05e83925b578f0",
      "size": 32336
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:46d371e02073acecf750a166495a63358517af793de739a51b680c973fae8fb9",
      "size": 848
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:b66c17bbf772fa072c280b10fe87bc999420042b5fce5b111db38b4fe7c40b49",
      "size": 162
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:cdf38b6e982439ad362e6f16c393ff005940917683abc9bc3e8bfcdf53c6f07a",
      "size": 175
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:74091f40cf03c3357d013d5808fc2e402478b35065d5603d4a8b5ce0d875c1c4",
      "size": 108
    },
    {
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
      "digest": "sha256:a9229ade96ca964d4d7653a7b399a2b69a23ee12a2a4ad20d6e8203ec6d44194",
      "size": 169
    }
  ]
}

Image configuration

Image layers

From the image to the bundle

From a container image layout, a container tool (e.g. CRI-O, containerd) will create a filesystem bundle, a.k.a. a container bundle for the container runtime (e.g. runc, kata-runtime) to use:

1. Find an image manifest
2. Find all the images layers
3. Apply all image layers in the specified order
4. Convert the image configuration into an OCI runtime index.json

layout --> Image index (index.json) --> Image manifest (blob) -----> Image configuration (blob) 
                                                                 |
                                                                 |
                                                                 \--> Image layers (blob)