Cloud Shell is a small Linux VM that opens in the console and is already signed in as you. For most day-to-day CLI work you do not need to install anything locally.
Open it
Console, top right: the >_ (Developer tools) icon, then Cloud Shell. It opens at the bottom of the page in the region currently selected in the console.
Check what you have:
oci --version
terraform -version
kubectl version --client
python3 --version; java -version 2>&1 | head -1
echo $OCI_REGION; echo $OCI_TENANCY
Your identity and region
Cloud Shell uses a delegation token for your console user, so commands run with your permissions. No API keys needed.
oci iam region list --output table
oci os ns get
oci iam compartment list --all --compartment-id-in-subtree true \
--query 'data[].name' --output table
Run a command in another region without switching the console:
oci compute instance list --compartment-id $COMP --region eu-amsterdam-1 --output table
Changing the region in the console header and restarting Cloud Shell changes its default region.
Files and persistence
- Your home directory (
$HOME) persists between sessions (a small quota; check the current limit in the docs). - Everything outside
$HOMEis reset when the session restarts. - Inactive home directories are deleted after a long period of non-use; do not treat Cloud Shell as storage.
Upload and download through the gear menu in the Cloud Shell toolbar. For larger files, use Object Storage:
oci os object put --bucket-name scratch --file ./report.csv
oci os object get --bucket-name scratch --name report.csv --file ./report.csv
Useful one-liners
Find an instance by name across all compartments:
oci search resource structured-search \
--query-text "query instance resources where displayName = 'web01'" \
--query 'data.items[].{name:"display-name", comp:"compartment-id", state:"lifecycle-state"}'
Get kubeconfig for an OKE cluster:
oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $HOME/.kube/config \
--region eu-frankfurt-1 --token-version 2.0.0 --kube-endpoint PUBLIC_ENDPOINT
kubectl get nodes
Run Terraform against your tenancy:
git clone https://github.com/your-org/oci-lab.git && cd oci-lab
terraform init && terraform plan
Reaching private resources
By default Cloud Shell has public internet access only. To reach a private OKE endpoint, a database or an instance on a private subnet, use Cloud Shell private networking: from the Cloud Shell menu, choose Network > Private network definition, pick a VCN and subnet, and Cloud Shell attaches to it. Your user needs the matching policies, and the subnet's security rules must allow traffic from Cloud Shell.
ssh -i ~/.ssh/id_ed25519 opc@10.0.1.25 # after switching to the private network
Limits to know
| Limit | Impact |
|---|---|
| Session times out after inactivity | Long jobs die; use an instance or Resource Manager |
| Small home directory | Not for large repos or data |
| Monthly usage limits | Heavy users may hit them |
| Tools versions set by Oracle | Pin your own Terraform/kubectl in $HOME/bin if needed |
| Cannot run as a server | No inbound ports |
Install your own tool versions in $HOME:
mkdir -p $HOME/bin && cd $HOME/bin
# download the binary you need, e.g. a pinned Terraform build, then
chmod +x terraform && export PATH=$HOME/bin:$PATH
Add the export line to ~/.bashrc so it persists.
Security notes
- Cloud Shell acts as you. Do not paste commands you do not understand from tickets or chat.
- Administrators can disable Cloud Shell with an IAM policy for groups that should not use it.
- Close it on shared screens; it stays signed in while the console session lasts.
Prevent it next time
- Keep scripts in Git, not only in Cloud Shell
$HOME. - Use Resource Manager or an automation instance for anything long-running or scheduled.
- Set up a private network definition once per team so people stop opening public SSH to reach private hosts.