The OCI image specification is the Open Container Initiative format that defines how a container image is described and distributed. It organizes an image into a manifest, a configuration object, and one or more filesystem layers. The manifest points to the image content, the configuration stores metadata such as entrypoint and environment, and the layers hold the packaged files.
This matters in security because scanners, registries, and runtimes all read OCI artifacts to decide what an image contains and whether it is trustworthy. A build-time scanner may inspect the layers for vulnerable packages, while a registry scanner may analyze the stored manifest and SBOM data before promotion. Attackers can abuse image supply chains by pushing malicious or tampered layers, or by hiding risky packages inside an inherited base image. Defenders use the OCI structure to verify signatures, compare digests, and build repeatable policy checks across the image lifecycle.