A developer asks what the Open Container Initiative (OCI) image specification actually standardises, as opposed to the OCI runtime specification. Which statement correctly distinguishes the image specification's role?
- AIt defines the gRPC API the kubelet uses to pull images from a registry
- BIt defines the format for packaging an image as layers, a manifest, and a configuration so any tool can build, store, and pull it Correct
- CIt defines how a running container is isolated at runtime using namespaces and cgroups
- DIt defines how registries authenticate users and enforce image signing policies
Why A is wrong: This conflates the OCI image spec with the Container Runtime Interface; image pulling is coordinated through CRI, and the OCI image spec does not define any kubelet gRPC API.
Why B is correct: The OCI image spec standardises the on-disk and registry format (layers, manifest, config), which is exactly what makes images portable across build tools, registries, and runtimes.
Why C is wrong: Namespace and cgroup isolation is a runtime concern closer to the OCI runtime spec and the kernel, not the image format, so this describes the wrong OCI specification.
Why D is wrong: Authentication and signing are handled by registry and supply-chain tooling rather than the OCI image spec, which describes the image artifact format itself, not access control.