CRI image lifecycle

Kubelet image requests use the same canonical image authority as Docker Compose support. An image declared by a block’s mocker.images metadata is handled as that catalog block. Every other valid image remains OCI content and is pulled, verified, unpacked, listed, inspected, and removed through Mocker’s OCI store. A name, tag, digest, label, annotation, or runtime handler cannot turn an unmatched image into a Stackie block.

Registry basic credentials, bearer tokens, and identity tokens stay in memory and are redacted from errors and debug output. CRI image IDs are the verified manifest digest, and the same value is returned by pull, list, and status operations. Removing a missing image succeeds idempotently.