Implementing OCI Artifact Storage Standards

Learners will explore storing non-container artifacts like Helm charts or configuration bundles within the registry using Open Container Initiative standards.

In this lesson, you will learn how to leverage OCI registry specifications to store non-container artifacts, such as Helm charts and configuration bundles, alongside your standard container images.

The Shift to Universal Artifact Registries

Traditionally, container registries were strictly for images. However, the Open Container Initiative (OCI) introduced the OCI Distribution Specification, which enables registries to store any arbitrary data as an "OCI Artifact." By treating non-container files as OCI artifacts, you can unify your supply chain, allowing your existing CI/CD pipelines and security scanning tools to handle Helm charts, WebAssembly modules, or Terraform plans using the same tooling—and the same security policies—as your Docker images.

Storing Artifacts with OCI-Compliant Tools

To store an artifact, you package the files into a standardized format and push them to the registry using tools like oras (OCI Registry As Storage). When you push these artifacts, the registry treats them as OCI blobs with specific mediaType definitions.

For example, pushing a Helm chart to an OCI-compliant registry transforms the chart into an OCI image layout. You can push a Helm chart without a traditional chart repository server:

# Packaging and pushing a Helm chart as an OCI artifact
helm package ./my-app
helm push my-app-0.1.0.tgz oci://my-registry.com/charts

Why This Matters for CI/CD

By adopting OCI standards for non-container artifacts, you gain three major advantages in your pipeline engineering:

Uniform Authentication: You use the same registry credentials and service accounts for both code (containers) and delivery manifests (Helm charts).
Standardized Security: Since these artifacts are now OCI images, you can apply your Cosign signing workflows to Helm charts just as easily as you do to production images.
Immutability: You can enforce the same registry-level retention and immutability policies on your configuration bundles that you apply to your container binaries, ensuring that a deployed chart remains unchanged throughout your promotion pipeline.

Key Takeaway: Implementing OCI artifact standards allows you to consolidate your entire software supply chain into a single, unified registry ecosystem, enabling consistent security, versioning, and distribution for both applications and their deployment configurations.