Use compartments as policy boundaries
Separate production, development, shared networks, and security services according to ownership and risk. Write policies at the narrowest practical scope. Apply names and tags for owner, environment, application, data class, and cost.
Use dynamic groups and machine identity for instance access to platform services. Avoid embedding user keys. Human and pipeline access should use distinct, monitored roles with strong authentication.
Design VCN traffic flows
Place entry points in controlled public subnets and application or data systems in private subnets. Network security groups should permit only required paths. Define routing, DNS, service access, egress, peering, and administrative connectivity explicitly.
Plan non-overlapping addresses for future hybrid and multi-cloud connections. Monitor gateways and tunnels, and test behavior when a path becomes unavailable.
Match compute and images
Evaluate processor architecture, memory, storage, networking, and software compatibility. Alternative architectures can be efficient only when every binary, container, and agent supports them. Benchmark with sustained, representative load.
Choose a supported Linux distribution and maintain approved image versions. Build hardening, agents, updates, and validation into a pipeline. Use small, observable bootstrap scripts and keep secrets outside images.
Make state and recovery explicit
Select block, local, file, or object storage according to access pattern and failure model. Encrypt data, monitor performance, and use application-aware backups. Replication supports availability; independent recovery points protect against corruption and deletion.
Test restoration into an isolated compartment or region, including identity, network, DNS, keys, images, and capacity. Review idle compute, orphaned volumes, old images, backups, transfer, and logging as part of cost governance.
