Docker Tutorial — OCI Standards
The Open Container Initiative (OCI) defines industry standards for container images and runtimes. These standards ensure that containers built with Docker can run on Podman, Kubernetes, or any OCI-compliant runtime — true portability.
What Is the OCI?
The OCI was founded in 2015 by Docker and other industry leaders under the Linux Foundation. Its goal: create open standards so containers aren’t locked into any single vendor.
Before OCI, Docker’s image format and runtime were proprietary. If Docker disappeared, your images might not work elsewhere. OCI solved this by standardizing three specifications.
The Three OCI Specifications
1. Image Specification
Defines how container images are structured:
- Manifest — metadata about the image (layers, config, platform)
- Layers — the filesystem changes that make up the image
- Config — runtime settings (entrypoint, environment variables, ports)
2. Runtime Specification
Defines how container runtimes create and manage containers:
- Filesystem bundle format
- Container lifecycle (create, start, stop, delete)
- Linux-specific settings (namespaces, cgroups, capabilities)
runc is the reference implementation of the OCI Runtime Spec. Docker, Podman, and containerd all use runc (or compatible alternatives).
3. Distribution Specification
Defines how container images are pushed and pulled from registries:
- API for uploading and downloading image layers
- Content addressing (images identified by SHA256 digest)
- Works with Docker Hub, GitHub Container Registry, AWS ECR, and any OCI registry
Why OCI Standards Matter
| Without OCI | With OCI |
|---|---|
| Docker images only work with Docker | Images work with any OCI runtime |
| Vendor lock-in | Freedom to choose tools |
| Proprietary formats | Open specifications |
| One runtime option | Many runtimes (runc, crun, gVisor, Kata) |
OCI in Practice
# Build an image with Docker
$ docker build -t myapp:1.0 .
# Push to an OCI-compliant registry
$ docker push myregistry.io/myapp:1.0
# Pull and run with Podman (no Docker needed)
$ podman pull myregistry.io/myapp:1.0
$ podman run myregistry.io/myapp:1.0
# Run on Kubernetes (uses containerd + runc)
# Same image, different runtime — works because of OCI standards
Summary
| Concept | Key Takeaway |
|---|---|
| OCI | Open Container Initiative — industry standards body |
| Image Spec | How container images are structured (layers, config, manifest) |
| Runtime Spec | How containers are created and managed (runc is reference impl) |
| Distribution Spec | How images are pushed/pulled from registries |
| Portability | OCI ensures images work across Docker, Podman, Kubernetes |
Quick Reference
OCI Standards (Open Container Initiative):
Image Spec → structure of container images
Runtime Spec → how to create/run containers (runc)
Distribution Spec → how to push/pull images from registries
Docker donated its image and runtime specs to OCI.
Result: any OCI image runs on any OCI runtime.
