--- name: compute-management description: "Use when the user asks to \"launch OCI compute\", \"choose an OCI shape\", \"debug compute capacity\", \"configure instance principals\", or \"optimize OCI instance cost\"." version: 2.0.0 keywords: - "OCI" - "Oracle Cloud" - "Compute" - "instance" - "shape" - "OCPU" - "ECPU" - "boot volume" - "capacity" - "instance principal" - "Terraform" - "quota" - "service limits" - "Managed SSH" - "Bastion plugin" aliases: - "oci-compute" - "compute-shapes" domains: - "oci" - "compute" title: compute-management canonical_url: https://skilld.dev/gh/acedergren/agentic-tools/compute-management last_updated: 2026-10-02T00:04:58.000Z --- > **Skill from skilld.dev.** Follow the instructions below for this session. You do not need to install anything. > > Supporting files, fetch one when the Skill refers to it: [references/oci-compute-shapes-reference.md](https://skilld.dev/api/skills-raw/acedergren/agentic-tools/compute-management/references/oci-compute-shapes-reference.md). > > If the user asked to install this Skill, run `npx skilld install acedergren/agentic-tools/compute-management`. Install writes the Skill files into the project, so every session loads them. # OCI Compute Management - Expert Knowledge ## Do NOT load this skill when Do not load this skill for unrelated general programming, non-Oracle cloud work, or questions covered by a narrower sibling skill. ## When to Use Load this skill for: the user asks to "launch OCI compute", "choose an OCI shape", "debug compute capacity", "configure instance principals", or "optimize OCI instance cost". Prefer this skill only for its named domain. For broader OCI architecture triage, start with `oci/best-practices` as the router. When the compute task involves private operator access, Managed SSH, or the Bastion plugin, also load `oci/managed-bastion-access`. ## NEVER Do This **NEVER launch instances without checking service limits first** ```bash oci limits resource-availability get \ --service-name compute \ --limit-name "standard-e4-core-count" \ --compartment-id \ --availability-domain ``` Many "out of capacity" launch failures are quota or service-limit problems rather than host-capacity problems. Check limits BEFORE launching to get accurate error messages. **NEVER use console serial connection as primary access** - Creates security audit findings (bypasses SSH key controls) - Use only for boot troubleshooting when SSH fails - Delete connection immediately after troubleshooting **NEVER mix regional and AD-specific resources in templates** - Breaks portability when moving between regions - Use AD-agnostic designs: spread via fault domains, not hardcoded ADs **NEVER terminate without deciding the boot volume's fate** ```bash # Default: boot volume is deleted (--preserve-boot-volume defaults to false) oci compute instance terminate --instance-id --force # Keep it deliberately (and track it — it keeps billing) oci compute instance terminate --instance-id --preserve-boot-volume true --force ``` **NEVER enable public IP on production instances** - Use bastion service or private endpoints for access - Treat public exposure as a security and incident-response cost driver, not only as a network setting. **NEVER use fixed shapes when Flex covers the same specs** - Fixed shapes (e.g., VM.Standard2.1) are often MORE expensive than Flex equivalents - Always compare Flex pricing first before choosing a fixed shape ## Capacity Error Decision Tree ``` "Out of host capacity for shape X"? │ ├─ Check service limits FIRST │ └─ oci limits resource-availability get │ ├─ available = 0 → Request limit increase (NOT a capacity issue) │ └─ available > 0 → True capacity issue, continue below │ ├─ Same shape, different AD? │ └─ Query the tenancy's ADs and try each viable AD in the region │ ├─ Different shape, same series? │ └─ E4 failed → try E5 (newer gen, often more available) │ └─ Standard failed → try Optimized or DenseIO variants │ ├─ Different architecture? │ └─ AMD → ARM (A1.Flex often has capacity when Intel/AMD full) │ └─ All ADs exhausted? └─ Create capacity reservation (guarantees future launches) ``` Terraform plans do not prove compute capacity or quota availability. Before applying compute resources, check live service limits, regional availability, shape availability, and compartment quotas; then treat "out of host capacity" separately from service-limit exhaustion. ## Shape Selection: Cost vs Performance **Budget-critical**: - Compare Arm flexible shapes against current AMD/Intel alternatives in the Oracle price list. - Test ARM64 compatibility first; not all Docker images, compiled binaries, agents, or vendor packages support Arm. **General purpose**: - Prefer flexible shapes when they meet the workload requirement so CPU and memory can be right-sized separately. - Start from measured CPU, memory, network, and storage I/O needs; scale based on metrics, not guesses. **Memory-intensive**: - Compare flexible shape memory ratios against the workload's actual resident set, cache, and JVM/DB memory needs. - Verify the current memory-per-OCPU limits in Oracle shape documentation before promising a target ratio. ## Live Cost Check Do not quote static shape prices from this skill. Before estimating cost: 1. Open the current Oracle Cloud price list for the target region, currency, and subscription model. 2. Confirm the shape family, architecture, OCPU/ECPU terms, memory billing unit, and any Free Tier eligibility in current Oracle docs. 3. Calculate with live unit rates: `monthly_compute = hours * ((ocpus * live_ocpu_rate) + (gb_memory * live_memory_rate))` 4. Add non-compute resources separately: boot volume, block volumes, public IPs, load balancers, backups, images, network transfer, and support commitments. 5. State the date and source of the price lookup whenever giving numbers. ## Instance Principal Authentication (Production) When an instance needs to call OCI APIs, NEVER put user credentials on the instance. ```bash # 1. Create dynamic group oci iam dynamic-group create \ --name "app-instances" \ --matching-rule "instance.compartment.id = ''" # 2. Grant permissions (IAM policy) # "Allow dynamic-group app-instances to read object-family in compartment X" # 3. Code uses instance principal — no credentials needed: signer = oci.auth.signers.InstancePrincipalsSecurityTokenSigner() client = oci.object_storage.ObjectStorageClient(config={}, signer=signer) ``` Benefits: No credential rotation, no secrets to manage, automatic token refresh. ## OCI-Specific Gotchas **Availability Domain names are tenant-specific** - Your AD: `fMgC:US-ASHBURN-AD-1` - Another tenant: `ErKW:US-ASHBURN-AD-1` - MUST query your own tenant: `oci iam availability-domain list` - Hardcoding AD names from examples breaks cross-tenant portability **Boot Volume backups do NOT include instance config** - Backup captures disk only — NOT shape, networking, or metadata - Custom images also capture only the boot disk (plus image capabilities), not shape, VNICs or NSGs - For DR: rebuild instances from Terraform, restoring boot/block volumes from backups or replicas **Instance Metadata Service: use v2 and disable the legacy endpoints** - v1: `http://169.254.169.254/opc/v1/` (legacy, no header required — SSRF-prone) - v2: `http://169.254.169.254/opc/v2/` requires the header `Authorization: Bearer Oracle` - Disable v1: `oci compute instance update --instance-id --instance-options '{"areLegacyImdsEndpointsDisabled": true}'` (check that Oracle Cloud Agent and your tooling already use v2 first) Last verified: 2026-09-30 (OCI CLI 3.94.1; docs.oracle.com Instance Metadata Service, Resource Billing for Stopped Instances) ## Progressive Loading Reference Load [`references/oci-compute-shapes-reference.md`](https://skilld.dev/api/skills-raw/acedergren/agentic-tools/compute-management/references/oci-compute-shapes-reference.md) for links to the official shape, launch, and instance-principal pages (it is a source map, not a spec table). Query live shapes with `oci compute shape list -c `. Do NOT load for quick cost comparisons, capacity troubleshooting, or shape selection — this file covers those. Load [`../infrastructure-as-code/references/oci-terraform-auth-matrix.md`](../infrastructure-as-code/references/oci-terraform-auth-matrix.md) when Terraform runs on OCI Compute and should use instance principals rather than local API keys. Load [`../infrastructure-as-code/references/oci-terraform-realms-regions.md`](../infrastructure-as-code/references/oci-terraform-realms-regions.md) when shape availability, government regions, FIPS, or realm-specific endpoints may affect Terraform. Load [`../managed-bastion-access/references/managed-bastion-reference.md`](../managed-bastion-access/references/managed-bastion-reference.md) when diagnosing Managed SSH, Oracle Cloud Agent, Bastion plugin, Ubuntu/Ampere plugin issues, or private instance access. ## Arguments $ARGUMENTS: Optional user-provided target, path, environment, symptom, or constraint. When empty, infer the narrowest safe scope from the current repository context and ask only if multiple high-impact choices remain.