5 parts — deep technical series.
Build, push, run, sign, and SBOM container images using only bare Linux tools and the actual specs — no Docker, no abstractions.
In this post we pull an Ubuntu base image, tear it open, add a static curl binary, and assemble a brand-new OCI image — using only skopeo, tar, jq, sha256sum, gzip, and wget. No Docker build. No Podman build. No Dockerfile. Every digest and byte count in this post is real, captured from an actual run.
Read Part 1 →In Part 1 we built an OCI image by hand. Now we push it to a server and pull it back — without skopeo, without a real registry — just curl and an nginx server with WebDAV. This strips away every abstraction and reveals what the OCI Distribution Spec actually is: a REST API for uploading and downloading content-addressable blobs....
Read Part 2 →In Part 1 we built an OCI image. In Part 2 we pushed and pulled it with raw HTTP. Now we run it — without runc, without Docker, without any container runtime. Just chroot, unshare, mount, and hostname. Four commands that are already on every Linux system.
Read Part 3 →In Part 1 we built an OCI image. In Part 2 we pushed and pulled it with raw HTTP. In Part 3 we ran it without a runtime. Now we sign it — and discover that a signature is just another OCI manifest with a subject field, stored alongside the image via the same Distribution API we already understand.
Read Part 4 →In Part 1 we built an OCI image. In Part 2 we pushed it with raw HTTP. In Part 3 we ran it with bare Linux primitives. In Part 4 we signed it with Notation and saw how the OCI 1.1 `subject` + Referrers mechanism works. Now we use the exact same plumbing to attach a Software Bill of Materials...
Read Part 5 →