Home / OCI

OCIRunbookIntermediate

Transformation: NFS file servers to OCI File Storage — design, copy and cutover

Move Linux NFS shares from on-premises filers or self-managed servers to OCI File Storage. Design mount targets and export options, copy with parallel rsync or fpsync, cut over clients and set up snapshots and replication.

Deepak Bhardwaj2 min read

Applies toOCI File Storage service (NFSv3), mount targets, export options, Linux NFS clients, rsync/fpsync

Design

Item Advice
File systems One per share or per app; snapshots and replication work per file system
Mount target In a private subnet reachable from clients; one mount target can serve many file systems
Export options Restrict by client CIDR; ROOT squash unless the app needs root; read-only where possible
Security NSG on the mount target: TCP/UDP 111, TCP 2048–2050, UDP 2048 from client subnets (check current docs)
Encryption Oracle-managed by default; customer-managed Vault key if required; in-transit TLS with the oci-fss-utils package

1. Create file system, mount target and export

oci fs file-system create --availability-domain $AD --compartment-id $C --display-name fs-projects
oci fs mount-target create --availability-domain $AD --compartment-id $C --subnet-id $SUBNET \
  --display-name mt-app --nsg-ids '["<nsg-ocid>"]'
oci fs export create --export-set-id <export-set-ocid> --file-system-id <fs-ocid> --path /projects \
  --export-options '[{"source":"10.0.20.0/24","access":"READ_WRITE","identitySquash":"ROOT","requirePrivilegedSourcePort":false}]'

2. Copy the data

Mount both on a copy host close to the source (or an OCI instance over FastConnect):

sudo mount -t nfs -o nfsvers=3 oldfiler:/vol/projects /mnt/src
sudo mount -t nfs -o nfsvers=3 10.0.10.15:/projects /mnt/dst

A single rsync is slow for millions of small files. Parallelise by top-level directory, or use fpsync (from the fpart package):

fpsync -n 16 -o "-aHAX --numeric-ids" /mnt/src/ /mnt/dst/

Run full copies early, then repeat to pick up changes. Preserve numeric UIDs/GIDs so permissions match on clients.

3. Cut over

  1. Freeze writes (set source read-only or stop the apps).
  2. Final rsync pass with --delete to mirror removals:
rsync -aHAX --numeric-ids --delete /mnt/src/ /mnt/dst/
  1. Update client mounts (fstab or autofs maps) to the mount target IP or DNS name:
10.0.10.15:/projects  /projects  nfs  nfsvers=3,_netdev,nofail,hard,timeo=600,retrans=2  0 0
  1. Validate file counts and spot-check permissions as an app user.

Tip

Use a DNS name (for example files.corp.local) in client mounts rather than the IP, so a future change of mount target is a DNS update.

4. Protect

  • Snapshot policies on each file system (hourly/daily with retention); users can restore from .snapshot.
  • Replication to another region for DR.
  • Monitor FileSystemUsage and throughput metrics; File Storage grows automatically, so watch cost rather than capacity.

Checklist

  • File systems, mount target, exports and NSG rules in place
  • Initial and incremental copies done with numeric IDs
  • Final sync with --delete during freeze
  • Clients remounted by DNS name; permissions tested
  • Snapshot policy and replication enabled; old filer retired

Related fixes