In Part 1 we built an OCI image. In Part 2 we pushed it with raw HTTP. In Part 3 we ran it with bare Linux primitives. In Part 4 we signed it with Notation and saw how the OCI 1.1 `subject` + Referrers mechanism works. Now we use the...
Read moreIn Part 1 we built an OCI image. In Part 2 we pushed and pulled it with raw HTTP. In Part 3 we ran it without a runtime. Now we sign it — and discover that a signature is just another OCI manifest with a subject field, stored alongside the...
Read moreIn Part 1 we built an OCI image. In Part 2 we pushed and pulled it with raw HTTP. Now we run it — without runc, without Docker, without any container runtime. Just chroot, unshare, mount, and hostname. Four commands that are already on every Linux system.
Read moreIn Part 1 we built an OCI image by hand. Now we push it to a server and pull it back — without skopeo, without a real registry — just curl and an nginx server with WebDAV. This strips away every abstraction and reveals what the OCI Distribution Spec actually...
Read moreIn this post we pull an Ubuntu base image, tear it open, add a static curl binary, and assemble a brand-new OCI image — using only skopeo, tar, jq, sha256sum, gzip, and wget. No Docker build. No Podman build. No Dockerfile. Every digest and byte count in this post is...
Read more