OCI Distribution is the open specification that defines how container images and related artifacts are stored, pushed, and pulled from registries. It standardizes a content-addressed model around manifests, layers, tags, and digests, so different registries and clients can exchange images in a predictable way.
It matters in cyber security because the registry is a trust boundary. Defenders use OCI-aware registries to enforce policy, mirror approved images, quarantine unknown content, and verify digests before deployment. Attackers target this layer by publishing poisoned base images, swapping tags to point to malicious content, or abusing compromised registry credentials. Good controls at the OCI Distribution layer help ensure that what a builder or runtime fetches is the exact artifact that was approved.