This is a cross issue but I'm opening it in rkt since it looks like a pod manifest extension to the appc pod manifest definition.

To run OCI images there's no need to implement the OCI runtime spec but like already done by docker2aci the OCI image config (referenced by the oci image manifest as the config blob with mediatype application/vnd.oci.image.serialization.config.v1+json) can be converted to an appc manifest (or, being more precise, just the App part) and consequently to a pod manifest app.

So the generated or provided runtime pod manifest app ImageID field can also point to an OCI image where ImageID will be the OCI image manifest digest.

The unique required change will be to just accept not only sha512 digests but also sha256 (and sha384 if/when used).

This will also work with a pod manifest template (#3000 (comment)), what'll be missing will be the discovery/fetching part that now is tied to appc discovery.

/cc @coreos/rkt-maintainers