OCI (Open Container Initiative)
Two specifications, one for the package and one for running it. That separation is why your builder and your runtime can come from different vendors.
-
-
Container Image
A layer is a changeset, not a snapshot. Removals are recorded as entries, which is why a deleted credential still ships.