OCI by Hand

We push and pull container images every day. docker push shows a few progress bars, and the image is in the registry. docker pull brings it back. For most of us, it’s a black box, and it works fine until something goes wrong. Have you ever compared the IDs? podman build prints one ID. The registry knows the image by a different digest. And the push log shows two more digests, but the registry has no blobs with these names. Which one is “the image”? Or a push fails with DIGEST_INVALID or MANIFEST_INVALID, and it’s not clear what the registry didn’t like. ...

In my previous post, I took a container image apart with curl. One thing from it stayed with me: a tag is just a name for a manifest digest, and anyone who can push can move it to another image. Think about what this means for a deployment. It pulls shop:1.0 and runs whatever the tag points to right now. If someone with a push token builds their own shop:1.0 and pushes it over ours, nothing looks different. The same name, the same tag, the same log line on start-up. ...