Consider publishing .NET base images as OCI formats instead of Docker formats

[baronfel]

Describe the Problem

The .NET base images today are publishes to MCR as Docker Manifest Lists comprised of individual Docker Manifests. These formats are older, but over the years the OCI formats have become the commonly-accepted standard. .NET should embrace this change and produce OCI-compatible Image Indexes and Images for our base images.

References

• OCI Layout specification
• oras CLI tool

[lbussell]

Perhaps stating the obvious, but this would be a breaking change and should be for new images only, meaning the earliest we could consider switching is .NET 10.

[richlander]

It would be great if we had user feedback to drive this change. This would help us balance any breaking changes w/benefits.

Have any of the official images on any of the big registries changes to this format?

[baronfel]

I haven't done an exhaustive search but the one that caused the SDK to support reading image manifests way back when was the official nginx container (at least for the alpine tag). It advertises quite a few sub-manifests:

unecessarily long manifest list

> docker manifest inspect nginx:alpine
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.oci.image.index.v1+json",
   "manifests": [
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2498,
         "digest": "sha256:679a5fd058f6ca754a561846fe27927e408074431d63556e8fc588fc38be6901",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:15da7178f7d152e0c169af3067cc31686581f5c33402637b7939e36b5d9eb80b",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2500,
         "digest": "sha256:63373ac63f2eab62f642f2d4f90945640c891057b956495ca033b9bca94db2d7",
         "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v6"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 567,
         "digest": "sha256:da06f0f5c54ff618231fe5f39699efb16262a27715e35644d861b8e36938f34f",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2500,
         "digest": "sha256:d6ba33f6106bd8244dba76eaa70aded5727f379c550b5a899b7c4dd7855407dc",
         "platform": {
            "architecture": "arm",
            "os": "linux",
            "variant": "v7"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:d8500278c9778d8b95a1800ec75c3d937c41b446ecb62dfa91ec84ff039111bc",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2500,
         "digest": "sha256:4338a8ba9b9962d07e30e7ff4bbf27d62ee7523deb7205e8f0912169f1bbac10",
         "platform": {
            "architecture": "arm64",
            "os": "linux",
            "variant": "v8"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:f4e84cf89b81de290ec4f197f24e3306a3f988c7b24ca3c09c2da7f816bca079",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2497,
         "digest": "sha256:fbcae75b6c5be0b2f7ad221f1b9acc48f33a85618414d1b84cbfd22e66275fc3",
         "platform": {
            "architecture": "386",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:78279553ff1fa7478b74b5223e7e0642cbf3045cddc0c25dff264e0239d856c9",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2500,
         "digest": "sha256:2007c064fb13cb4eea067808152fa1b80287edcbfaee51461dd1e8e460669ec3",
         "platform": {
            "architecture": "ppc64le",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:8bc47b5a4b9ad7ffc1e76149c57e10be45f2319471ae2088146bafa4d9d3a637",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2500,
         "digest": "sha256:8bb37aac1c92580867f2715c3fd7dfe7d003a2f081fd4b06444c6e7a7baa5306",
         "platform": {
            "architecture": "riscv64",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:98c4dd57fe0666279723fa3f80d9a61e08e4ce8895329414fff5eb3eeafad6da",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 2498,
         "digest": "sha256:3170540e9db6ebe8899782402c853e50dc9db2110e04ca5f1da436136628d9be",
         "platform": {
            "architecture": "s390x",
            "os": "linux"
         }
      },
      {
         "mediaType": "application/vnd.oci.image.manifest.v1+json",
         "size": 840,
         "digest": "sha256:ec411c7a5f1cf67fdbe5ca07e8302dcd0bf9da074b5937a109194ef6b42beed4",
         "platform": {
            "architecture": "unknown",
            "os": "unknown"
         }
      }
   ]
}

It would be good to have more structure around the request - I just wanted to have a place to hang the discussion on :)

[baronfel]

For further clarification, the actual internal customer need was to emit OCI formats. Today, if the base image used for an SDK-generated container is OCI, we will emit OCI. As a result, no applications based off of the .NET base images will be OCI. In dotnet/sdk#46011 we've added a flag that will allow a user to request a specific format, OCI or Docker - this should satisfy the internal customer need and prevent any sort of pressure to implement this issue. We should have plenty of space to do research before moving here.