Encrypt parts of bottles

[nathan-joslin]

Looks like encrypted images are possible in OCI and here is the best practice for doing so overview and MR

Notice that they settled on +encrypted (like +tar and +zstd) to specify that a layer is encrypted. They use JWK for cypto. They use a KEK to wrap the CEK with asymmetric crypto. The content is encrypted with symmetric crypto with the CEK. What digest value is used for the blob id (plaintext or ciphertext digest)?

The user would provide the KEK.

Looks like ocicrypt might be helpful.