Home / OCI

OCIChecklistBeginner

Standalone OCI compute instance production build checklist

Shape, fault domain, boot and block volume settings, backups, Bastion access, OS Management, monitoring and the recovery behaviour you get from a single OCI instance.

Deepak Bhardwaj2 min read

Applies toOCI Compute (VM shapes, Oracle Linux and Windows Server)

Placement and shape

  • Flexible shape (for example VM.Standard.E5.Flex) sized from measurements: OCPUs and memory set separately.
  • Availability domain and fault domain chosen consciously (record them; they matter later for HA pairs).
  • Private subnet; no public IP. Access via OCI Bastion sessions (managed SSH) or VPN.
  • Shielded instance (Secure Boot, Measured Boot) where the image supports it.
oci compute instance launch --availability-domain "Abcd:AP-MUMBAI-1-AD-1" --fault-domain FAULT-DOMAIN-2 \
  --compartment-id <cmp> --shape VM.Standard.E5.Flex --shape-config '{"ocpus":4,"memoryInGBs":64}' \
  --subnet-id <private-subnet-ocid> --assign-public-ip false --image-id <image-ocid> \
  --display-name app01-prod --nsg-ids '["<app-nsg-ocid>"]'

Storage

  • Boot volume size and VPUs (performance units) set for the workload; data on separate block volumes.
  • Block volumes at Balanced (10 VPU) or Higher Performance (20 VPU) for databases; auto-tune performance if traffic varies.
  • Encryption with a Vault key if required (customer-managed keys).
  • Paravirtualized or iSCSI attachment chosen per OS guidance; consistent device paths (/dev/oracleoci/oraclevdb) in /etc/fstab with _netdev,nofail.

Backups

  • Backup policy (Oracle-defined Bronze/Silver/Gold or custom) assigned to the boot volume and block volumes, ideally through a volume group so all volumes are backed up consistently together.
  • Cross-region backup copy in the policy for DR.
  • Test restore: create a volume from backup, attach it to a test instance.
oci bv volume-backup-policy-assignment create --asset-id <boot-volume-ocid> --policy-id <gold-policy-ocid>

Operations

  • Oracle Cloud Agent plugins: Compute Instance Monitoring, OS Management Hub, Bastion, Vulnerability Scanning.
  • Patch schedule in OS Management Hub.
  • Alarms on CPU, memory, disk (custom metric or agent), instance health (oci_compute_infrastructure_health).
  • Instance availability configuration: live migration preferred, and recoveryAction: RESTORE_INSTANCE so the instance restarts after infrastructure maintenance or failure.

What a single instance survives

Event Result
Planned infrastructure maintenance Live migration (no reboot) for most VM shapes, or reboot migration with notice
Host hardware failure Instance recovered on healthy hardware (restart)
Fault domain issue Down until recovered
AD or region outage Restore from backup / cross-region copy

If that's not enough, move to an instance pool across fault domains behind a load balancer (see the OCI HA posts).

Related fixes