That's the case for Range - https://getrange.sh/ - runs any OCI image without pulling it. HTTP range requests FTW! :)