Compute
Compute
This domain tests shape selection, instance lifecycle, pooled deployments, and secure API access from instances. Expect questions that combine compute with IAM and networking.
Core rules
- An OCPU is a physical core. On x86, 1 OCPU = 2 vCPUs; on Ampere A1, 1 OCPU = 1 core. Flexible shapes let you choose OCPUs and memory within the shape's per-OCPU memory limit.
- Boot volumes are separate block volumes. Termination has a
preserve_boot_volumechoice; attached data volumes are not automatically deleted with the instance. - Instance metadata service (IMDS) supplies user data and instance identity. IMDSv2 requires a session token. Instance principals use IMDS certificates plus a dynamic group and policy.
- Instance configurations capture shape, image, metadata, and VNIC settings. Instance pools launch identical instances and can autoscale on CPU or a schedule.
- Capacity reservations hold compute capacity in an availability domain; instances must match the reservation's shape and AD.
Worked example
A pool of four app VMs must read a Vault secret. Create an instance configuration using VM.Standard.E4.Flex, 2 OCPU and 16 GB, in a private subnet with cloud-init. Create dynamic group pool-dg with instance.compartment.id = 'ocid1.compartment.oc1..app' and policy allow dynamic-group pool-dg to read secret-bundles in compartment App. The app uses an instance-principal signer. New pool instances match the compartment rule and inherit access; the policy, not the image, grants it.
Traps
- Putting user API keys in a custom image instead of using instance principals.
- Expecting instance principals to work from on-premises hosts.
- Selecting memory above the flexible shape's per-OCPU cap.
- Assuming terminating an instance always deletes every attached volume.
- Forgetting the policy after creating the dynamic group.