OCI Container Image
Category:
Definition
An OCI (Open Container Initiative) container image is a standardized packaging format for software that bundles an application, its runtime dependencies, and configuration into a portable, immutable artifact that can run on any compliant container runtime.
Detailed Explanation
The Open Container Initiative (OCI) was founded in 2015 by Docker, CoreOS, and other industry participants to define open standards for container formats and runtimes. OCI images are what most people call "Docker images" — Docker popularized the format, and OCI standardized it.
**Structure of an OCI image:**
An OCI image consists of: 1. **Manifest** — a JSON document listing the image's layers and configuration 2. **Config** — metadata including environment variables, exposed ports, CMD, and ENTRYPOINT 3. **Layers** — immutable filesystem snapshots, stacked on top of each other (union filesystem)
Each Dockerfile instruction (FROM, RUN, COPY, etc.) creates a new layer. Layers are content-addressed by SHA256 digest and cached, which is why only changed layers need to be rebuilt or pulled.
**Where OCI images are stored:**
OCI images are stored in container registries. Public registries include: - Docker Hub (hub.docker.com) - GitHub Container Registry (ghcr.io) - Google Artifact Registry (pkg.dev) - Amazon ECR (ecr.aws)
**Why the OCI standard matters:**
Before OCI, Docker's proprietary image format meant images could only reliably run on Docker. OCI ensures images built with any compliant tool (Docker, Buildah, Kaniko, BuildKit) run on any compliant runtime (containerd, CRI-O, podman).
How Kubeletto provides OCI Container Image
Kubeletto pulls OCI images from any compliant registry (Docker Hub, GHCR, ECR, GCR, and private registries with credentials). Build pipelines use BuildKit to produce OCI-compliant images from Dockerfiles or buildpack-generated Dockerfiles. Images are stored in Kubeletto's internal registry and deployed to Knative Serving as container workloads.
Frequently Asked Questions
Is a Docker image the same as an OCI image?
Effectively yes for most purposes. Docker images built with modern Docker are OCI-compliant. The Docker image format predates OCI but has been aligned with the standard since 2017.
What registries does Kubeletto support?
Kubeletto supports any OCI-compliant registry: Docker Hub, GHCR, Google Artifact Registry, Amazon ECR, and private registries with credentials provided via Kubeletto's secret environment variables.
How do layers affect deployment speed?
Layers that haven't changed don't need to be re-pulled. If your base image and dependencies haven't changed, only your application code layer is transferred on new deploys, making deploys faster.
See OCI Container Image in action
Deploy your first app on Kubeletto — free during our active beta.