dnf update fails on an OCI Oracle Linux instance: regional yum server, ociregion variable and service gateway checks

You run sudo dnf update on an Oracle Linux instance in OCI and it hangs on "Oracle Linux 8 BaseOS Latest", fails with Curl error (28): Timeout was reached, or reports Could not resolve host: yum$ociregion.$ocidomain. Patching is blocked and OS Management Hub jobs fail the same way.

On OCI, Oracle Linux platform images download packages from a regional yum server inside the Oracle Services Network. Instances in a private subnet reach it through the service gateway, so they need neither a NAT gateway nor internet access. Two yum variables, $ociregion and $ocidomain, build the repository URL. In almost every case, either those variables are wrong or the network path to the regional server is broken.

#Quick triage

Run these first and keep the output:

sudo dnf -v makecache 2>&1 | grep -Ei 'baseurl|error|curl|resolve' | head -20
grep -h '^baseurl' /etc/yum.repos.d/*.repo | sort -u | head
ls -l /etc/dnf/vars/ /etc/yum/vars/ 2>/dev/null
cat /etc/dnf/vars/ociregion /etc/dnf/vars/ocidomain 2>/dev/null
cat /etc/yum/vars/ociregion /etc/yum/vars/ocidomain 2>/dev/null

Oracle Linux repo files use a base URL like this:

baseurl=https://yum$ociregion.$ocidomain/repo/OracleLinux/OL8/baseos/latest/$basearch/

Oracle documents two behaviours that matter here:

• $ociregion (for example -phx) selects the regional server. $ocidomain sets the domain it lives in.
• If the ociregion file doesn't exist or is empty, the URL points to the public Oracle Linux yum server (yum.oracle.com) instead of the regional one.

That second rule explains most "it worked yesterday" tickets.

#Check 1: the yum variables

Compare against a healthy platform-image instance in the same region:

# on the healthy instance
for f in ociregion ocidomain; do printf '%s=' $f; cat /etc/dnf/vars/$f 2>/dev/null || cat /etc/yum/vars/$f; done

On the broken instance, DNF systems (OL8, OL9) read /etc/dnf/vars/. OL7 with yum reads /etc/yum/vars/. Some images keep the files in one place and link the other, so check both.

Fix by writing the same values you saw on the healthy instance:

sudo mkdir -p /etc/dnf/vars
echo '<ociregion value from healthy host>' | sudo tee /etc/dnf/vars/ociregion
echo '<ocidomain value from healthy host>' | sudo tee /etc/dnf/vars/ocidomain
sudo dnf clean all && sudo dnf makecache

Tip

Images moved between regions, imported from on-premises, or built by tools that "clean" /etc often lose these files. If you build custom images, check for them in your image pipeline (see "Prevent it next time").

If the files are present but ociregion is deliberately empty, someone pointed the host at the public server. That only works with a NAT gateway or other internet egress.

#Check 2: DNS and HTTPS to the regional server

Build the actual hostname and test it:

R=$(cat /etc/dnf/vars/ociregion); D=$(cat /etc/dnf/vars/ocidomain)
H="yum${R}.${D}"; echo "$H"
getent hosts "$H"
curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' \
  "https://${H}/repo/OracleLinux/OL8/baseos/latest/x86_64/repodata/repomd.xml"

Change OL8 and x86_64 to match your release and architecture (aarch64 on Ampere).

• getent returns nothing: check /etc/resolv.conf. The VCN resolver is 169.254.169.254. If you replaced it with an on-premises DNS server, that server must forward OCI names back to the VCN resolver.
• curl hangs and exits with code 28: this is a network path problem, so go to check 3.
• curl returns 200: the path is fine. Look at proxies and repo configuration (check 4).

#Check 3: service gateway, route table and egress rules

From your workstation or Cloud Shell:

SUBNET=<subnet-ocid>
RT=$(oci network subnet get --subnet-id $SUBNET --query 'data."route-table-id"' --raw-output)
oci network route-table get --rt-id $RT --query 'data."route-rules"' --output table

VCN=$(oci network subnet get --subnet-id $SUBNET --query 'data."vcn-id"' --raw-output)
C=$(oci network subnet get --subnet-id $SUBNET --query 'data."compartment-id"' --raw-output)
oci network service-gateway list --compartment-id $C --vcn-id $VCN \
  --query 'data[].{name:"display-name",state:"lifecycle-state",services:services,block:"block-traffic"}'

oci network service list --query 'data[].{name:name,cidr:"cidr-block"}' --output table

Check these in order:

1. A service gateway exists, is AVAILABLE, and block-traffic is false.
2. It serves the right service. Use the All <region> Services in Oracle Services Network option. A gateway created only for Object Storage is a common reason why backups to buckets work but dnf does not.
3. The subnet's route table has a rule whose destination is that same services CIDR label and whose target is the service gateway. In the console, this destination type is "Service" rather than a CIDR block.
4. Egress rules allow TCP 443 to the services CIDR, in the subnet's security lists and in any NSG on the VNIC:

oci network subnet get --subnet-id $SUBNET --query 'data."security-list-ids"'
oci network security-list get --security-list-id <seclist-ocid> --query 'data."egress-security-rules"'
oci network nsg rules list --nsg-id <nsg-ocid> --direction EGRESS --output table

Warning

A route table can hold only one rule per destination. Changing the services CIDR target from the service gateway to a NAT gateway, or to a DRG for firewall inspection, moves Object Storage, yum and other OCI-service traffic for every instance in that subnet. Confirm the impact before you edit a shared route table.

If traffic goes through a hub firewall, make sure the firewall allows the regional yum hostname and returns the traffic symmetrically. VCN flow logs and Network Path Analyzer show where packets stop.

#Check 4: proxy, clock and repo configuration

grep -i proxy /etc/dnf/dnf.conf /etc/yum.conf 2>/dev/null; env | grep -i _proxy
chronyc tracking | grep -E 'System time|Leap'
dnf repolist --enabled

• A corporate proxy in dnf.conf or in the environment can send traffic away from the service gateway. Remove it for the yum host, or set proxy=_none_ on the Oracle repos.
• A clock that is minutes off breaks TLS. Point chrony at 169.254.169.254 and resync.
• If a repo was disabled or a release package removed, reinstall the release package and re-enable the repo. Package names vary by version. Use dnf list "*release-el8*" to see what is available.

sudo dnf reinstall oraclelinux-release-el8
sudo dnf config-manager --enable ol8_baseos_latest ol8_appstream
sudo dnf clean all && sudo dnf makecache

#Fix: verify end to end

After your change:

sudo dnf clean all
sudo dnf makecache
sudo dnf check-update | tail -5

If the instance is managed by OS Management Hub, re-run the failed job after makecache succeeds. Otherwise it keeps reporting the old failure.

#Prevent it next time

• Image pipeline check. Fail the build if ociregion or ocidomain is missing:

for f in /etc/dnf/vars/ociregion /etc/dnf/vars/ocidomain; do
  [ -s "$f" ] || { echo "missing $f"; exit 1; }
done

• Subnet standard. Every private subnet route table gets a service gateway rule for "All Services in Oracle Services Network". Add it to your Terraform module rather than creating it by hand.
• Don't reuse an Object Storage-only gateway. Change it to All Services, and record why in the gateway's description.
• Monitor patching. Alert on failed OS Management Hub jobs, or run a scheduled dnf -q makecache that exits non-zero on failure, so a broken path shows up before patch night.
• Document non-Oracle repos. List every third-party repo that needs internet egress, and either provide NAT or mirror it internally.