Home / OCI

OCIRunbookIntermediate

Backing up and restoring OCI boot and block volumes

Set up policy-based backups, take on-demand backups before changes, restore a boot volume to a new instance and copy backups to another region for DR.

Deepak Bhardwaj2 min read

Applies toOCI Block Volume service, OCI CLI 3.x

Backup options at a glance

Option Use it for
Backup policy (Oracle-defined Bronze/Silver/Gold or custom) Scheduled protection with automatic retention
On-demand backup (full or incremental) Before patching, upgrades or risky changes
Volume group backup Crash-consistent backups across several volumes, such as DB data and log disks
Clone An instant copy in the same AD for testing. A clone is not a backup.
Cross-region copy DR in a second region

Assign a backup policy

# List policies (Oracle-defined ones live in the root/tenancy)
oci bv volume-backup-policy list --query "data[].{name:\"display-name\",id:id}" --output table

# Attach a policy to a boot or block volume
oci bv volume-backup-policy-assignment create \
  --asset-id $BOOT_VOLUME_ID --policy-id $POLICY_ID

Tip

Add the backup policy to your instance Terraform module, so a volume can't exist without one.

On-demand backup before a change

oci bv boot-volume-backup create --boot-volume-id $BOOT_VOLUME_ID \
  --display-name "pre-patch-$(date +%F)" --type INCREMENTAL --wait-for-state AVAILABLE

oci bv backup create --volume-id $BLOCK_VOLUME_ID \
  --display-name "pre-upgrade-$(date +%F)" --type FULL --wait-for-state AVAILABLE

For an application-consistent backup, quiesce or flush the application first (for example, put the database in backup mode or stop writes).

Restore a boot volume

  1. Restore the backup to a new boot volume (it can be in any AD in the region):
    oci bv boot-volume create --boot-volume-backup-id $BACKUP_ID \
  --availability-domain "Uocm:AP-MUMBAI-1-AD-1" --display-name restored-boot \
  --wait-for-state AVAILABLE
  2. Launch a new instance from it:
    oci compute instance launch -c $C --availability-domain "Uocm:AP-MUMBAI-1-AD-1" \
  --shape VM.Standard.E5.Flex --shape-config '{"ocpus":2,"memoryInGBs":16}' \
  --subnet-id $SUBNET --source-boot-volume-id $NEW_BOOT_VOLUME_ID --display-name app-restored
  3. Or replace the boot volume on the existing instance in place, using Replace boot volume in the console or oci compute instance update --source-details.

Warning

The restored instance gets a new private IP unless you specify one with --private-ip. Update DNS or load balancer backends as needed.

Restore a block volume

oci bv volume create --volume-backup-id $VOL_BACKUP_ID \
  --availability-domain "Uocm:AP-MUMBAI-1-AD-1" --display-name data-restored --wait-for-state AVAILABLE
oci compute volume-attachment attach --instance-id $ID --volume-id $NEW_VOL_ID --type paravirtualized

Then mount it in the guest. For iSCSI attachments, run the iscsiadm commands shown in the console.

Cross-region copy for DR

oci bv boot-volume-backup copy --boot-volume-backup-id $BACKUP_ID \
  --destination-region ap-hyderabad-1 --display-name dr-copy
oci bv backup copy --volume-backup-id $VOL_BACKUP_ID --destination-region ap-hyderabad-1

Custom backup policies can also copy backups to a destination region automatically.

Test it

A backup you've never restored isn't proven. Restore one critical volume to an isolated subnet every quarter, boot it, and record how long it took. That number is your real RTO.

Related fixes