oci

A registry stores repositories, which hold manifests, which point at content-addressed blobs. Candidates who can draw that hierarchy and the auth dance around it understand every pull failure they will ever meet.

Most candidates say the registry figures it out. The real mechanism is an index of per-platform manifests and a client-side choice at pull time, and knowing which layer makes that choice is the whole question.