Docker and the OCI Standards

You build the quicknotes image with Docker. Production runs on Kubernetes, which does not use Docker at all, and a colleague prefers a tool called Podman. Will your image work for all of them? It will, and the reason is a set of open standards that sit underneath Docker.

The rule

Docker is one tool; OCI is the shared format every tool agrees on.

Docker is a collection of software for building, sharing and running containers. When you type a command, several pieces cooperate:

• the docker CLI, which only sends requests;
• dockerd, the Docker daemon that manages images, containers, networks and volumes;
• containerd, which supervises the life of each container;
• runc, a small program that asks the kernel to create the isolated process.

The Open Container Initiative (OCI) is an open project, run under the Linux Foundation since 2015, where companies agreed on common specifications. Three matter to you:

• the image specification: how an image's layers and settings are packaged;
• the runtime specification: how a runtime turns an unpacked image into a running container (runc is its reference implementation);
• the distribution specification: how registries store and serve images over HTTP.

Because the quicknotes image follows the image spec, any OCI-compliant tool can run it:

The second line assumes the image has reached Podman's store, for example by pushing it to a registry and pulling it. No conversion step is involved.

The shortcut

Picture the chain of hand-offs: CLI → dockerd → containerd → runc → your process. Each link does one job, and the formats passed between them are standards, so links can be swapped.

The trap is treating "Docker" and "containers" as the same word. Docker is a popular toolset; containers are a Linux feature; OCI is the agreement that makes images portable between toolsets.

Drills

Answer fast — trust the rule.

Remember

• Docker is one toolset; OCI defines the shared image, runtime and distribution formats.
• Shortcut: CLI → dockerd → containerd → runc → process.
• Trap: "Docker" is not a synonym for "containers"; other OCI tools run the same images.