Are you using ORAS?

[FeynmanZhou]

🙌🏻 Hi ORAS community fellows,

ORAS has been used by a lot of organizations and integrated by OCI registries listed on the Adopter page. We’re looking to better understand the adoption of ORAS across the community. If your team, project, or organization is using ORAS—whether in production, research, or experimentation, we’d love to hear from you. 😉

Sharing your use case will help us elevate ORAS from CNCF Sandbox to Incubation, highlight community success stories, and guide the project’s future direction.

Please consider adding your organization or project name below so we can recognize your contributions and build a stronger ecosystem together. This is very helpful to the entire ORAS community.

[FeynmanZhou]

Microsoft is using ORAS and several ORAS libraries to manage and distribute OCI artifacts (SBOM, signatures, attestations) with container images in OCI registries. See reference doc.

[vsoch]

At LLNL our converged computing projects have used ORAS for pretty extensive experimentation - in a large performance study last year we were able to easily save, retrieve, and parse over 25k experimental results saved in a GitHub package with tags corresponding to experiment environments. We also built a state machine operator that runs in Kubernetes that deploys a registry on the fly and uses ORAS to stage data between workflow steps. Finally, we used it for a compatibility study where we designed and used an ML model spec stored as an artifact to assist with image selection.

The first two studies were accepted to workshops for the upcoming Supercomputing conference in November, and the third is a manuscript draft we are submitting soon. The first is on arxiv https://arxiv.org/abs/2506.02709, and I’m happy to share the second and third offline if there is interest.

[jonesbusy]

Jenkins project is using ORAS (Java SDK) to implement plugins and offload some storage on OCI (caches, libraries, pipeline script, artifacts, etc...)

At ELCA (A Swiss company) we have implemented a Kubernetes Operator (Using Quarkus Operator SDK) to manage our on-premises infrastructure. We use the ORAS Java SDK (via it's Quarkus extension) to push/pull OCI state files to perform a Gitless GitOps reconciliation (A bit similar to the Flux Source controller)

I'm waiting an answer for a talk in a KCD (https://community.cncf.io/events/details/cncf-kcd-suisse-romande-presents-kcd-suisse-romande/) related to the Operator SDK topic

If accepted ORAS will be mentionned

[thomastaylor312]

The wasmCloud project (CNCF incubating) is a huge downstream consumer of the Rust OCI client, which is a subproject of ORAS. wasmCloud is used by various companies both large and small. It is used as the main storage and fetching mechanism for Wasm components that are run by wasmCloud.

Relatedly, the Rust OCI client is also used in key downstream Wasm projects via the wasm package toolchain and oci-wasm, of which I am also a maintainer.

In both cases, the ORAS project has provided both a home and community support for the Rust OCI client project that has been invaluable to us as maintainers.

[flavio]

Kubewarden

The Kubewarden project (CNCF sandbox) make use of the Rust OCI client too, which is a subproject of ORAS.

Kubewarden's policies are WebAssembly modules that are distributed as OCI artifacts.

Sigstore

The Sigstore official Rust library, of which I'm a maintainer, makes use of the Rust OCI client too.