🧱 Oracle Cloud Services: A Map for People Who Know Linux

How Oracle Cloud is organized (tenancy, compartments, OCIDs), the services you meet first, a translation list from Linux ideas to OCI ones, what the Always Free allowances cover, and what quietly bills

How Oracle Cloud is organized

The structure is tenancy → compartments → resources:

• The tenancy is your account and the root compartment. Everything you own is below it.
• Compartments are folders for related resources: you use them to organize and isolate resources, to measure usage and billing, and to control access with policies. A common plan is one compartment per project or team. They can be nested.
• Resources (instances, volumes, networks, buckets) each belong to one compartment, and have an OCID, a unique ID (ocid1.instance.oc1.phx...) that you paste into commands and policies.

Policies attach to a compartment (or the tenancy) and are written as sentences:

Allow group Developers to manage instance-family in compartment lab

Access given at a higher level applies to everything below it. By default nobody but the Administrators group can do anything.

Tags and cleanup

• Tags are labels on resources, which you can use in budgets and cost reports.
• There is no one-click "delete the folder with everything in it". The documentation I read says nothing about deleting a compartment with resources: in general you terminate or delete the resources first. A practical rule: write down what you create, and keep each experiment in its own compartment so that you can list it with oci ... list --compartment-id.
• Resource Manager is OCI's managed Terraform: you describe resources in files as a stack, and a destroy job removes them. This is the safest cleanup route when you do real work.

Ways to work

• The Console (a website), Cloud Shell (a terminal in it, already signed in), the OCI CLI (oci SERVICE ...), SDKs, and Terraform or Resource Manager for repeatable setups.

The first services you will meet

Compute

• Compute instances. Virtual machines, in two forms. A shape is the size and type: the Always Free ones are VM.Standard.E2.1.Micro (AMD, a fraction of a core and 1 GB) and VM.Standard.A1.Flex (Arm, flexible: you choose the OCPUs and memory). Flexible shapes let you set the OCPUs and memory yourself. You choose an image (Oracle Linux, Ubuntu and others: the console labels the ones that are Always Free eligible), an SSH key pair, and a VCN and subnet.
• Boot volume. The disk with the operating system. Oracle's documentation says the boot volume holds the OS and software, and changes to it are lost on termination (unless you choose to keep it), while attached volumes keep their data.
• Kubernetes (OKE), Functions and Container Instances exist too: not covered here (compare the Kubernetes node access tutorial for the idea).

Storage

• Object Storage. Objects in buckets, inside a namespace that belongs to your tenancy. Tiers: Standard, Infrequent Access, Archive. The Always Free allowance is 20 GB on a free-only account.
• Block Volume. Extra disks for instances. The Always Free limit is 200 GB total, boot volumes and block volumes together, with 5 backups.
• File Storage. A shared network file system over NFS: compare the NFS page, where we built the same idea ourselves.

Networking

• VCN (Virtual Cloud Network). Your private network in a region, with subnets (public or private), route tables, an internet gateway (for public traffic) and a NAT gateway (so private machines can reach out). The console has a VCN wizard ("Create VCN with Internet Connectivity") that builds a working set, as the free VM guide shows. Create the VCN before the instance.
• Two layers of firewall: the cloud rules in a security list or network security group (allow rules for the VCN), and the firewall in the instance's own operating system. Oracle's stock images ship with iptables rules that allow little more than SSH, so a cloud rule alone is not enough. Both must allow the traffic: the pf page explains the same ideas for a firewall you control.
• Load Balancer (the free allowance is one flexible 10 Mbps load balancer), Network Load Balancer, DNS, Site-to-Site VPN (up to 50 IPSec connections are in the allowance: compare the WireGuard page for a tunnel you build yourself) and the Bastion service (free).

Identity and secrets

• IAM with identity domains, groups and policies (above), and Vault (keys and secrets: the allowance has 150 secrets).

Data

• Autonomous Database (the allowance is two, each 1 CPU and 20 GB), MySQL HeatWave (one single node in the allowance) and NoSQL. Always Free databases must be in the home region.

Watching and cost

• Monitoring, Logging, Notifications (the idea of the monitoring page as a service), and Budgets and Cost Analysis (see the account page).

Linux idea, Oracle Cloud idea

• sudo and file permissions → IAM policies on a compartment
• Users in /etc/passwd → IAM users in an identity domain
• A password or key in a config file → Vault
• A disk and /etc/fstab → Block Volume (one instance) or File Storage (shared, NFS)
• iptables, nftables, pf → security lists or network security groups, plus the instance's own firewall
• nginx as a reverse proxy → Load Balancer
• /var/log and syslog → Logging
• Cron → a scheduled Function (from the documentation, not run here)
• Backups with rsync or zfs send → volume backups (5 in the free allowance) and Object Storage
• /etc/hosts and DNS servers → DNS
• SSH key login stays SSH key login: you give a public key at launch, and the user is ubuntu on Ubuntu images and opc on Oracle Linux

What the free allowance covers, and what bills

Everything in the Always Free list is free as long as you stay inside it (the numbers are on the account page). What can still cost you, from the documentation I read and from the free VM guide:

• Anything not marked Always Free. The console labels eligible images and shapes. Pick only those.
• Block storage beyond 200 GB, and volumes outside the home region (Oracle says they incur charges).
• Extra reserved public IPs, extra load balancers, bigger shapes.
• The trial's paid resources are reclaimed at the end unless you upgrade: it will not silently charge you, but you will lose them.
• A1 instances over the allowance during the trial are disabled and deleted after 30 days unless you upgrade.
• The idle rule: an Always Free instance under 20% CPU and network for 7 days can be reclaimed.
• Stopped instances. Oracle's page on stopped-instance billing could not be read, and it depends on the shape. So do not assume: for something you do not need, terminate it, and tick the box to delete the boot volume.

The cleanup habit: a compartment per experiment, terminate what you do not need, check Cost Analysis the next day.

A first small path (from the documentation, not run here)

A tidy first experiment that needs no server: a compartment, a bucket, a file, and then all removed. It needs a configured CLI (oci setup config).

oci iam compartment create --compartment-id TENANCY_OCID --name lab --description "learning lab"
oci os ns get
oci os bucket create --compartment-id LAB_COMPARTMENT_OCID --name lab-bucket
echo "hello from oci" > hello.txt
oci os object put --bucket-name lab-bucket --file hello.txt
oci os object list --bucket-name lab-bucket
oci os object delete --bucket-name lab-bucket --object-name hello.txt
oci os bucket delete --bucket-name lab-bucket

• The first command makes a compartment under the tenancy (its OCID is in the console). The result prints the new compartment's OCID: keep it for the next command.
• os ns get prints your Object Storage namespace, and bucket create makes a bucket in the compartment.
• object put, list and delete copy a file in, show it and remove it. A bucket must be empty before it can be deleted.
• Then check Cost Analysis the next day. Deleting the compartment itself is not covered here (not verified).

What this page did not cover

OKE (Kubernetes), Functions, the Always Free database features in detail, networking topologies, DevOps pipelines, the AI and analytics services, and everything not named above. Oracle's documentation covers each of them in depth.

The cheat sheet

• Structure: tenancy (root compartment) → compartments (nestable) → resources with OCIDs. Policies are sentences: Allow group G to VERB RESOURCE in compartment C.
• First services: Compute (E2.1.Micro, A1.Flex), Object Storage, Block Volume, File Storage, VCN with security lists, IAM and Vault, Autonomous Database, Monitoring and Budgets.
• Free allowance: 2 AMD micro VMs, A1 2 OCPUs and 12 GB, 200 GB block, 20 GB object, 2 autonomous databases, 10 TB outbound. Home region only for compute and databases.
• Two firewalls: the cloud security list or NSG, and the instance's own iptables or firewalld.
• Linux to Oracle Cloud: sudo is policies, fstab is Block Volume or File Storage, pf is security lists plus the OS firewall, secrets in files are Vault.
• Billing traps: anything not Always Free, storage over 200 GB, volumes outside the home region, extra reserved IPs, a stopped instance (unclear: terminate), the idle rule.
• Tidy experiment: oci iam compartment create, oci os bucket create, oci os object put, delete the object and the bucket.

← Oracle Cloud Regions, Availability Domains and Fault Domains · ↑ All tutorials