An OCI image manifest is a small JSON document that names one container image's configuration and its ordered layers, each by digest, for a single architecture and operating system. An image index is a separate document that points to several manifests, one per platform. The manifest is what a registry actually serves.
The parts of a manifest
According to the Open Container Initiative image specification, a manifest has these main properties:
| Property | Meaning |
|---|---|
| schemaVersion | Must be 2, for backward compatibility with older Docker clients |
| mediaType | Identifies the document type |
| config | A descriptor pointing at the image configuration blob |
| layers | An array of descriptors, one per layer, in order |
| annotations | Optional metadata |
Each descriptor carries a media type, a digest and a size. The digest is a hash of the referenced content. That is the key idea: the manifest does not hold the layers, it names them by hash.
Manifest versus index
The specification contrasts the two directly. An index contains information about a set of images that can span architectures and operating systems. A manifest provides a configuration and a set of layers for a single image for a specific architecture and operating system.
So myapp:1.0 as a tag often resolves to an index, and the index points at an amd64 manifest and an arm64 manifest. Which digest you pin matters. See which digest to pin for a multi-arch image.
Why this matters for security
- The manifest digest identifies exactly what you run. Change one layer and the manifest digest changes.
- Signatures and attestations usually target a manifest or index digest, not a tag name.
- A scanner reading an image reads the manifest, fetches each layer, and lists the packages inside. It can report against the digest you deploy.
- Registries can store extra artifacts that refer to a manifest, such as signatures and SBOMs. See the OCI referrers API.
How to look at one
Most registry tools can print the manifest for a reference. Look for the config digest, the list of layers, and whether the top level document is a manifest or an index. If it is an index, follow each entry to its manifest.
A short checklist
- Record the digest you tested.
- Deploy by digest, not only by tag.
- Know whether your digest is an index or a platform manifest.
- Sign and scan that digest.
- Keep the SBOM linked to it.
Safeguard's container image scanning reads layers and reports packages and vulnerabilities per image, and its SBOM generation ties the inventory to the build.
Try it yourself
Click through it at your own pace, or open it full screen. Notice that the result is organised by image layers and packages, which come from the manifest.
Quick check
Does a manifest contain the layer data?
No. It lists descriptors with digests and sizes. The layer blobs are stored and fetched separately.
Is a tag the same as a manifest?
No. A tag is a name that points at a manifest or index digest, and it can be moved unless the registry enforces immutability.
Sources
Last reviewed: 19 October 2026.
