Source: infoq.com
Overview
Docker has donated the cnab-to-oci library to the Cloud Native Application Bundle (CNAB) project, hosted at cnab.io. The library allows teams to convert CNAB application bundles into a format that can be pushed to and pulled from OCI-compliant container registries, reusing existing registry infrastructure without requiring new distribution systems.
What Is CNAB?
The Cloud Native Application Bundle (CNAB) specification is a cloud-agnostic standard for packaging and running distributed applications. It was originally co-developed by Docker, Microsoft, HashiCorp, Bitnami, Codefresh, and others, and was announced at DockerCon Europe 2018.
CNAB introduces the concept of a bundle — a self-describing package that can represent applications composed of multiple components. Bundles can reference and incorporate:
- Helm charts
- Kubernetes manifests
- Terraform or other infrastructure templates
- Dockerfiles and container images
This makes CNAB suitable for complex, multi-tool application deployments that span cloud environments.
Anatomy of a CNAB Bundle
A CNAB bundle consists of three main parts:
- bundle.json (the descriptor): Metadata that includes versioning information, configurable parameters, and references to all images and components in the bundle.
- The invocation image: A container image that holds the actual installer logic — the workflow needed to install, upgrade, or uninstall the application. It can include declarative configurations from tools like Helm and kubectl, and it manages the full bundle lifecycle.
- Bundle repositories: Metadata describing where component images are stored and how to retrieve them.
How cnab-to-oci Works
The cnab-to-oci tool is a reference implementation for distributing CNAB bundles using OCI-compliant or Docker registries. It leverages the OCI image index — defined in the OCI Image Specification — to package and store bundle data.
The OCI image index is typically used by clients to discover platform-specific image manifests. However, the spec is deliberately open about the kinds of media it can contain, which cnab-to-oci exploits to store:
- The CNAB bundle metadata (
bundle.json) - The invocation image
- All component images referenced by the bundle
Currently, cnab-to-oci uses OCI annotations (which are optional fields in the OCI spec) to communicate the media type of each artifact stored in the index. A proposal was under discussion at the time of this announcement to add a formal mediaType field to the OCI index spec, which would make annotations unnecessary for this purpose.
Atomic Transfer and Registry Consistency
Beyond simple packaging, cnab-to-oci is designed to ensure that all images referenced by a bundle are stored in the same registry and can be transferred atomically between registries. This provides end-users with a consistent, reliable view of a bundle — all required artifacts move together, reducing the risk of broken references or partial transfers.
Who Uses cnab-to-oci?
At the time of the donation, cnab-to-oci was already in use by several tools in the CNAB ecosystem:
- Docker App: Docker’s own implementation of the CNAB specification.
- Porter: A CNAB-compatible bundle management tool.
- Duffle: A reference implementation of the CNAB specification.
Standardizing CNAB Registry Distribution
The CNAB specification intentionally does not mandate a single distribution method for bundles — this flexibility is by design, allowing teams to use different backends suited to their environment. However, to improve interoperability, the CNAB Registries specification included a proposal to standardize how OCI registries can be used for bundle distribution. The cnab-to-oci donation moves that work into the shared CNAB project, making it available to all implementers rather than being owned by a single vendor.
Why This Matters
By donating cnab-to-oci to the CNAB project, Docker signals its commitment to a vendor-neutral approach to bundle distribution. Teams that already operate OCI-compliant registries — including Docker Hub, Amazon ECR, Google Artifact Registry, and Harbor — can use them to store and distribute CNAB bundles without deploying additional infrastructure. This reduces operational overhead and keeps multi-tool application packaging within familiar registry workflows.