What Is a Standard Container: Diving Into the OCI Runtime Spec

TL;DR Per the OCI Runtime Specification:

• Containers are isolated and restricted boxes for running processes 📦
• Containers pack an app and all its dependencies (including OS libs) together
• Containers are for portability - any compliant runtime can run a standard image bundle
• Containers can be implemented using Linux, Windows, and other OS-es
• Virtual Machines also can be used as standard (i.e., OCI-compliant) containers 🤐

There are many ways to create containers, especially on Linux. Besides the super widespread Docker implementation, you may have heard about LXC, Incus, systemd-nspawn, or maybe even OpenVZ.

The general concept of the container is quite vague. What's true and what's not often depends on the context, but the context itself isn't always given explicitly. For instance, there is a common saying that containers are Linux processes or that containers aren't Virtual Machines. However, the first statement is just an oversimplified attempt to explain Linux containers. And the second statement simply isn't always true.

In this article, I'm not trying to review all possible ways of creating containers. Instead, the article is an analysis of the OCI Runtime Specification. The spec turned out to be an insightful read! For instance, it gives a definition of the standard container (and no, it's not a process) and sheds some light on when Virtual Machines can be considered containers.

The form of containers Docker brought later became a standard (OCI), and most modern container runtime implementations are OCI-compliant. Today we even use the terms container, Docker container, and Linux container interchangeably. However, this is just one type of OCI-compliant container. So, let's take a closer look at the OCI Runtime Specification.

What is Open Container Initiative (OCI)

Open Container Initiative (OCI) is an open governance structure that was established in 2015 by Docker and other prominent players of the container industry to express the purpose of creating open industry standards around container formats and runtimes. In other words, OCI develops specifications for standards on Operating System process and application containers.

What is an OCI Container

So, how does OCI define a Container nowadays?

A Standard Container is an environment for executing processes with configurable isolation and resource limitations.

Why do we even need containers?

[To] define a unit of software delivery ... The goal of a Standard Container is to encapsulate a software component and all its dependencies in a format that is self-describing and portable, so that any compliant runtime can run it without extra dependencies, regardless of the underlying machine and the contents of the container.

Ok, and what can we do with containers?

[Containers] can be created, started, and stopped using standard container tools; copied and snapshotted using standard filesystem tools; and downloaded and uploaded using standard network tools.

Operations on containers that OCI runtimes must support: Create, Start, Kill, Delete, and Query State.

Well, makes sense. But... a container cannot be a process then!