Open Policy Containers: Policy-as-Images for OPA
Shriira Press
Treat your authorization policies the way you treat your containers — built, tagged, signed, pushed, and pulled, with a
policyCLI that feels exactly like Docker.
Welcome to Open Policy Containers: Policy-as-Images for OPA.
Open Policy Containers, known as OPCR, is a CNCF sandbox project that brings the familiar Docker workflow to Open Policy Agent. Authorization logic written in Rego tends to live as loose files and hand-assembled tarball bundles, with no standard way to version it, sign it, or move it between environments — which is a strange gap, given how much trust we place in the rules that decide who can do what. OPCR closes that gap by packaging OPA policies as OCI container images: artifacts you can tag with a semantic version, push to any OCI registry, pull back down, and cryptographically sign with cosign so a consumer can prove a policy is exactly what its author published. The CLI that does this work is simply called policy, and it deliberately mirrors docker command for command. This book begins with the policy-distribution problem, then explains the policy-as-images idea and how OPA bundles map onto OCI manifests and blobs. From there it walks through the policy CLI end to end, opens up the on-disk and on-registry architecture, covers signing and the secure software supply chain with cosign and Sigstore, and closes with how OPCR fits into real OPA deployments.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press