1
{
2
  "schemaVersion": 2,
3
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
4
  "config": {
5
    "mediaType": "application/vnd.oci.image.config.v1+json",
6
    "size": 7023,
7
    "digest": "sha256:b5b2b2c507a0944348e0303114d8d93aaaa081732b86451d9bce1f432a537bc7"
8
  },
9
  "layers": [
10
    {
11
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
12
      "size": 32654,
13
      "digest": "sha256:9834876dcfb05cb167a5c24953eba58c4ac89b1adf57f28f2f9d09af107ee8f0"
14
    },
15
    {
16
      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
17
      "size": 16724,
18
      "digest": "sha256:3c3a4f68c8e1e3e2b5c26a0e7e1f6a8c9b2d1e4f5a6b7c8d9e0f1a2b3c4d5e6"
19
    }
20
  ],
21
  "annotations": {
22
    "org.opencontainers.image.source": "https://github.com/example/app"
23
  }
24
}

1
{
2
  "architecture": "amd64",
3
  "os": "linux",
4
  "config": {
5
    "User": "nginx",
6
    "ExposedPorts": {"80/tcp": {}},
7
    "Env": [
8
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
9
      "NGINX_VERSION=1.25.3"
10
    ],
11
    "Entrypoint": ["/docker-entrypoint.sh"],
12
    "Cmd": ["nginx", "-g", "daemon off;"],
13
    "Volumes": {"/var/cache/nginx": {}},
14
    "WorkingDir": "/",
15
    "Labels": {"maintainer": "NGINX Docker Maintainers"}
16
  },
17
  "rootfs": {
18
    "type": "layers",
19
    "diff_ids": [
20
      "sha256:a1b2c3d4e5f6...",
21
      "sha256:b2c3d4e5f6a7..."
22
    ]
23
  },
24
  "history": [
25
    {"created": "2024-01-01T00:00:00Z", "comment": "ADD file:..."},
26
    {"created": "2024-01-01T00:01:00Z", "comment": "CMD [\"/bin/sh\"]"}
27
  ]
28
}

1
# 查看镜像层的内容
2
docker save nginx -o nginx.tar
3
tar -xf nginx.tar
4

5
# 查看某一层的文件列表
6
layer_id=$(cat manifest.json | python3 -c "
7
import json, sys
8
m = json.load(sys.stdin)
9
print(m[0]['Layers'][0])
10
")
11
tar -tzf "$layer_id" | head -20
12

13
# 查看 whiteout 文件
14
tar -tzf "$layer_id" | grep ".wh."

1
{
2
  "schemaVersion": 2,
3
  "mediaType": "application/vnd.oci.image.index.v1+json",
4
  "manifests": [
5
    {
6
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
7
      "digest": "sha256:abc123...",
8
      "size": 7143,
9
      "platform": {"architecture": "amd64", "os": "linux"}
10
    },
11
    {
12
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
13
      "digest": "sha256:def456...",
14
      "size": 7143,
15
      "platform": {"architecture": "arm64", "os": "linux"}
16
    }
17
  ]
18
}

1
my-bundle/
2
├── config.json     # 容器运行时配置
3
└── rootfs/         # 容器的根文件系统
4
    ├── bin/
5
    ├── dev/
6
    ├── etc/
7
    ├── lib/
8
    ├── proc/
9
    ├── sys/
10
    └── usr/

1
# 创建 OCI Bundle
2
mkdir -p /tmp/bundle/rootfs
3
cd /tmp/bundle
4
docker export $(docker create busybox) | tar -C rootfs -xvf -
5
runc spec    # 生成默认 config.json

1
{
2
  "ociVersion": "1.0.2",
3
  "process": {
4
    "terminal": true,
5
    "user": {"uid": 0, "gid": 0},
6
    "args": ["sh"],
7
    "env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"],
8
    "cwd": "/",
9
    "capabilities": {
10
      "bounding": ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"],
11
      "effective": ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"],
12
      "permitted": ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"]
13
    },
14
    "rlimits": [{"type": "RLIMIT_NOFILE", "hard": 1024, "soft": 1024}],
15
    "noNewPrivileges": true
16
  },
17
  "root": {"path": "rootfs", "readonly": true},
18
  "hostname": "mycontainer",
19
  "mounts": [
20
    {"destination": "/proc", "type": "proc", "source": "proc"},
21
    {"destination": "/dev", "type": "tmpfs", "source": "tmpfs", "options": ["nosuid","noexec","mode=755"]},
22
    {"destination": "/sys", "type": "sysfs", "source": "sysfs", "options": ["nosuid","noexec","ro"]}
23
  ],
24
  "linux": {
25
    "namespaces": [
26
      {"type": "pid"},
27
      {"type": "mount"},
28
      {"type": "ipc"},
29
      {"type": "uts"},
30
      {"type": "network"}
31
    ],
32
    "resources": {
33
      "memory": {"limit": 536870912},
34
      "cpu": {"quota": 200000, "period": 100000}
35
    },
36
    "seccomp": {
37
      "defaultAction": "SCMP_ACT_ERRNO",
38
      "architectures": ["SCMP_ARCH_X86_64"],
39
      "syscalls": [{"names": ["accept","access","arch_prctl"], "action": "SCMP_ACT_ALLOW"}]
40
    }
41
  }
42
}

1
# OCI 运行时的标准操作流程
2
runc create mycontainer     # 创建容器（状态：Created）
3
runc start mycontainer      # 启动容器（状态：Running）
4
runc state mycontainer      # 查看状态
5
runc kill mycontainer SIGTERM  # 发送信号
6
runc delete mycontainer     # 删除容器

1
# 使用 OCI Distribution API 拉取镜像
2
# 1. 获取 Manifest
3
curl -s -H "Accept: application/vnd.oci.image.manifest.v1+json" \
4
  https://registry.example.com/v2/myapp/manifests/latest
5

6
# 2. 下载 Config
7
curl -s \
8
  https://registry.example.com/v2/myapp/blobs/sha256:b5b2b2c507a...
9

10
# 3. 下载 Layer
11
curl -s \
12
  https://registry.example.com/v2/myapp/blobs/sha256:9834876dcfb...

1
# containerd 的镜像拉取流程（简化）
2
ctr image pull docker.io/library/nginx:latest
3

4
# 底层操作：
5
# 1. GET /v2/library/nginx/manifests/latest → 获取 Manifest
6
# 2. 解析 Manifest，获取 Config 和 Layers 的 digest
7
# 3. 检查本地是否已有对应 blob（跳过已下载的层）
8
# 4. GET /v2/library/nginx/blobs/sha256:xxx → 下载缺失的 blob
9
# 5. 解压 layers 到 OverlayFS
10
# 6. 验证 digest 一致性

1
// containerd 将 OCI Image 转换为 OCI Bundle（简化）
2
func imageToBundle(image ocispec.Image, rootfs string) (*specs.Spec, error) {
3
    spec := &specs.Spec{
4
        Version: specs.Version,
5
        Process: &specs.Process{
6
            Args: image.Config.Cmd,
7
            Env:  image.Config.Env,
8
            Cwd:  image.Config.WorkingDir,
9
        },
10
        Root: &specs.Root{
11
            Path:     rootfs,
12
            Readonly: false,
13
        },
14
        Mounts: defaultMounts(),
15
        Linux: &specs.Linux{
16
            Namespaces: defaultNamespaces(),
17
        },
18
    }
19

20
    // 处理 Entrypoint + Cmd
21
    if len(image.Config.Entrypoint) > 0 {
22
        spec.Process.Args = append(image.Config.Entrypoint, image.Config.Cmd...)
23
    }
24

25
    // 处理 User
26
    if image.Config.User != "" {
27
        uid, gid := parseUser(image.Config.User)
28
        spec.Process.User = specs.User{UID: uid, GID: gid}
29
    }
30

31
    return spec, nil
32
}

1
#!/bin/bash
2
# 手动构建 OCI 镜像（不使用 Docker）
3

4
set -e
5
IMAGE_DIR="/tmp/oci-image"
6
mkdir -p $IMAGE_DIR/blobs/sha256
7

8
# 1. 创建 rootfs 层
9
ROOTFS_DIR="/tmp/rootfs"
10
mkdir -p $ROOTFS_DIR/{bin,etc,dev,proc,sys}
11
echo '#!/bin/sh' > $ROOTFS_DIR/bin/hello
12
echo 'echo "Hello OCI!"' >> $ROOTFS_DIR/bin/hello
13
chmod +x $ROOTFS_DIR/bin/hello
14
echo "root:x:0:0::/root:/bin/sh" > $ROOTFS_DIR/etc/passwd
15

16
# 2. 打包层
17
cd $ROOTFS_DIR
18
tar -cf layer.tar .
19
LAYER_DIGEST=$(sha256sum layer.tar | cut -d' ' -f1)
20
mv layer.tar $IMAGE_DIR/blobs/sha256/$LAYER_DIGEST
21
LAYER_SIZE=$(stat -c%s $IMAGE_DIR/blobs/sha256/$LAYER_DIGEST)
22

23
# 3. 创建 Config
24
CONFIG=$(cat <<EOF
25
{
26
  "architecture": "amd64",
27
  "os": "linux",
28
  "config": {"Cmd": ["/bin/hello"]},
29
  "rootfs": {"type": "layers", "diff_ids": ["sha256:$LAYER_DIGEST"]}
30
}
31
EOF
32
)
33
echo -n "$CONFIG" > config.json
34
CONFIG_DIGEST=$(sha256sum config.json | cut -d' ' -f1)
35
CONFIG_SIZE=$(stat -c%s config.json)
36
mv config.json $IMAGE_DIR/blobs/sha256/$CONFIG_DIGEST
37

38
# 4. 创建 Manifest
39
MANIFEST=$(cat <<EOF
40
{
41
  "schemaVersion": 2,
42
  "mediaType": "application/vnd.oci.image.manifest.v1+json",
43
  "config": {"mediaType": "application/vnd.oci.image.config.v1+json", "size": $CONFIG_SIZE, "digest": "sha256:$CONFIG_DIGEST"},
44
  "layers": [{"mediaType": "application/vnd.oci.image.layer.v1.tar", "size": $LAYER_SIZE, "digest": "sha256:$LAYER_DIGEST"}]
45
}
46
EOF
47
)
48
echo -n "$MANIFEST" > manifest.json
49
MANIFEST_DIGEST=$(sha256sum manifest.json | cut -d' ' -f1)
50
mv manifest.json $IMAGE_DIR/blobs/sha256/$MANIFEST_DIGEST
51

52
# 5. 创建 Image Layout
53
echo '{"imageLayoutVersion":"1.0.0"}' > $IMAGE_DIR/oci-layout
54
echo "{\"schemaVersion\":2,\"manifests\":[{\"mediaType\":\"application/vnd.oci.image.manifest.v1+json\",\"digest\":\"sha256:$MANIFEST_DIGEST\",\"size\":$(stat -c%s $IMAGE_DIR/blobs/sha256/$MANIFEST_DIGEST)}]}" > $IMAGE_DIR/index.json
55

56
echo "OCI Image created at $IMAGE_DIR"

1
#!/bin/bash
2
# 从 OCI 镜像创建 Bundle 并运行
3

4
# 1. 从上面的 OCI 镜像解压 rootfs
5
BUNDLE_DIR="/tmp/my-bundle"
6
mkdir -p $BUNDLE_DIR/rootfs
7
cd $BUNDLE_DIR
8

9
# 解压层到 rootfs
10
tar -xf /tmp/oci-image/blobs/sha256/* -C rootfs/
11

12
# 2. 生成 config.json
13
runc spec
14

15
# 3. 修改 process.args
16
python3 -c "
17
import json
18
with open('config.json') as f:
19
    spec = json.load(f)
20
spec['process']['args'] = ['/bin/hello']
21
with open('config.json', 'w') as f:
22
    json.dump(spec, f, indent=2)
23
"
24

25
# 4. 运行
26
sudo runc run my-oci-container
27
# Hello OCI!

1
mkdir -p /tmp/oci-bundle/rootfs
2
cd /tmp/oci-bundle

1
docker export $(docker create alpine:latest) | tar -xf - -C /tmp/oci-bundle/rootfs/

1
runc spec

1
python3 -c "
2
import json
3
with open('/tmp/oci-bundle/config.json') as f:
4
    spec = json.load(f)
5
print('ociVersion:', spec.get('ociVersion'))
6
print('process.args:', spec.get('process', {}).get('args'))
7
print('namespaces:', [ns['type'] for ns in spec.get('linux', {}).get('namespaces', [])])
8
"

1
ociVersion: 1.2.0
2
process.args: ['sh']
3
namespaces: ['pid', 'network', 'ipc', 'uts', 'mount', 'cgroup']

1
python3 -c "
2
import json
3
with open('/tmp/oci-bundle/config.json') as f:
4
    spec = json.load(f)
5
spec['process']['args'] = ['/bin/sh', '-c', 'echo \"Hello from OCI container!\"; hostname; ps aux']
6
spec['process']['terminal'] = False
7
with open('/tmp/oci-bundle/config.json', 'w') as f:
8
    json.dump(spec, f, indent=2)
9
"

1
cd /tmp/oci-bundle && runc run my-oci-demo

1
Hello from OCI container!
2
runc
3
PID   USER     TIME  COMMAND
4
    1 root      0:00 ps aux