Creating a Container Instance

In the Basic information step, fill out the following information:

1. Name: Enter a name for the container instance. You can add or change the name later. The name doesn't need to be unique because an Oracle Cloud Identifier (OCID) uniquely identifies the container instance. Avoid entering confidential information.

2. Create in compartment: Select the compartment to create the instance in. The other resources that you select can come from different compartments.

3. Availability domain: Select the Availability domain that you want to create the instance in.

4. Fault domain (Optional): By default, the system selects a fault domain for you. Alternatively, select Specify fault domain to select the fault domain to use for the instance. For more information, see Fault Domains.

5. Shape: Select the flexible shape for the container instance. Flexible shapes have a customizable number of OCPUs and amount of memory.

   Select Change shape to change the shape, and then specify:

   • Number of OCPUs: For Number of OCPUs, select the number of OCPUs that you want to allocate to this instance. The other resources scale proportionately.
   • Amount of memory (GB): For Amount of memory (GB), select the amount of memory that you want to allocate to this instance. The amount of memory allowed is based on the number of OCPUs selected.

6. Containers Behavior: Configure container behavior for the container instance.

   • Graceful shutdown timeout (seconds): Set the amount of time that the container instance waits for the OS to shut down before powering off. If you don't specify a graceful shutdown timeout, the default is 0 seconds.
   • Container restart policy: You can set the restart policy for the containers in a container instance when you create them. When an individual container exits (stops, restarts, or fails), the exit code and exit time are available in the API and the restart policy is applied. If all containers exit and don't restart, the container instance shuts down.

     Select one of the following options:

     • Always: Containers always restart, even if they exit successfully. "Always" is preferred if you want to ensure that your container is always running, such as a web server. This policy setting is the default.
     • Never: Containers never restart, regardless of why they exited.
     • On failure: Containers restart only if they exit with an error. "On failure" is preferred if you want to accomplish a certain task and ensure that it completes successfully.

7. Tags: In the Tags section, add tags to the container instance. If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace.

   For more information about tagging, see Resource Tags. If you're not sure whether to apply tags, skip this option or ask your administrator. You can apply tags later.

8. Select Next.

In the Storage section, you can add up to 32 storage items. You can add file storage, empty directories, and configuration files.

1. Select the Actions button, and then select:

   • Manage file storage:
     1. Select or create a mount target. You can select an existing mount target, enter its OCID, or create a mount target by specifying its display name, compartment, availability domain, and tags.

        The mount target must be reachable from the container instance subnet; otherwise, the container instance cannot mount the file system and container instance creation fails.

     2. Add one or more file storage volumes for the selected mount target. For each volume, select an existing export or create an export by specifying an export path.
     3. Select Oracle-managed encryption or customer-managed encryption.

        To use customer-managed encryption, select a vault and key that already exist.

     4. Specify any supported NFSv3 mount options. For the supported options and their behavior, see Supported Mount Options.
     5. Select Update.

     For more information, see Mounting File System Service Resources.

   • Manage empty directory:
     1. Select Add empty directory.
     2. Enter a name, and choose either Ephemeral storage or Memory as the backing store.
     3. Optionally add another empty directory, or select Update.
   • Manage configuration file:
     1. Select Add configuration file.
     2. Add a named volume with one or more files.

        For each file, provide a file name, an optional relative path, and uploaded or inline content. If no relative path is specified, the file is available at the root of the volume.

     3. Select Update.
2. Select Next.

In the Containers section, you can add up to 60 containers for a container instance.

Select Add container, then provide the following container information:

1. Name: Enter a display name for the first container. You can add or change the name later. The name doesn't need to be unique, because an Oracle Cloud Identifier (OCID) uniquely identifies the container. Avoid entering confidential information.
2. Image: Select Select image, and then select the container image source:

   • OCI Container Registry: An Oracle-managed registry that enables you to store, share, and manage container images.

     1. Select the repository compartment, repository, and image tag.

        For more information, see Container Registry.

     2. Select Select image.

   • External registry: An external registry, such as Docker Hub, where you can select an image provided by third-party vendors.

     1. Select the registry hostname, repository, and image tag.
     2. Select the registry credentials type. You can host container images in private registries or repositories that require authorization in order to pull the images.

        You can select either None, Basic, or OCI Vault Secret.

     3. If you select Basic, then specify the registry username and password.
     4. If you select OCI Vault Secret, then provide the registry username and password through a vault secret. Specify the vault compartment, vault, and define a secret.

        For more information, see Vault Secrets for Image Pull Authorization.

     5. Select Select image.
3. Environmental variables: Set the environmental variables used by the container.

   Container images support environment variables to customize their execution. For example, the official NGINX image supports NGINX_HOST and NGINX_PORT environment variables, so you can set the value to customize the execution to the following variables:

   NGINX_HOST=foobar.com
   NGINX_PORT=80

   1. Select + Another variable.
   2. Enter a key and value pair.
4. Storage: Add up to 60 storage mounts from the storage that you created in the Storage step.
   1. Select Add storage.
   2. Enter the storage, mount path, and subpath.
   3. Specify if the storage is read-only.
   4. Select Add storage to add another storage mount.
5. Startup options: Configure the working directory, command, and arguments for the container entry point. The working directory must be an absolute path.
6. Security: You can specify the security settings of the container.
   1. Select Enable read-only root filesystem to apply read-only access to the root filesystem of the container.
   2. Select Run as non-root user to ensure that the container doesn't run as the root user.
      • When you enable Run as non-root user, the User ID value cannot be set to 0.
   3. Use the User ID and Group ID fields to set the user ID (ID) and group ID (GID) to run the entry point process of the container.
      • You must set the User ID before you set the Group ID.
      • The value for User ID and Group ID must be an integer between 0 and 65535. The default value is 0.
      • The User ID and Group ID values that you specify override values that are set in the container image. When the User ID value is not specified, the entry point process of the container runs as root user.
   4. Under Configure Linux capabilities, configure Linux capabilities for your container. By default, the container launches with several capabilities that you can select to drop.

      Both the Drop capabilities and Add capabilities fields support the ALL value, which allows or drops all capabilities. The value ALL refers to the Linux capabilities that are enabled by default.

      • If you leave both Drop capabilities and Add capabilities blank, all default capabilities are available for your container.
      • If you enter ALL in the Drop capabilities field, the container contains only the capabilities that you list in the Add capabilities field.
      • If you enter ALL in the Add capabilities field, all capabilities are available except those that you list in the Drop capabilities field, and the container ignores ALL in the Drop capabilities field.
      • For cases when neither the Drop capabilities field nor the Add capabilities field has value ALL, all the capabilities listed in the Drop capabilities field are dropped from the default set and the capabilities listed in the Add capabilities field are added, becoming the final list of capabilities for your container.
      • The creation of the container instance fails if you provide any capabilities that are not in the following list:

      All Linux capabilities enabled by default when you create a container

      Capability	Description
      CAP_CHOWN	Makes changes to file UIDs and GIDs.
      CAP_DAC_OVERRIDE	Discretionary access control (DAC) that bypasses file read, write, and execute permission checks.
      CAP_FSETID	Does not clear set-user-ID and set-group-ID mode bits when a file is modified. Sets the set-group-ID bit for a file whose GID does not match the file. system or any of the supplementary GIDs of the calling process.
      CAP_FOWNER	Bypasses permission checks on operations that normally require the file system UID of the process to match the UID of the file, excludes the operations that are covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH.
      CAP_MKNOD	Creates special files using mknod(2).
      CAP_NET_RAW	Uses RAW and PACKET sockets. Binds to any address for transparent proxying.
      CAP_SETGID	Makes manipulations of process GIDs and supplementary GID list. Forges GID when passing socket credentials via UNIX domain sockets. Writes a group ID mapping in a user namespace.
      CAP_SETUID	Makes manipulations of process UIDs. Forges UID when passing socket credentials via UNIX domain sockets. Writes a user ID mapping in a user namespace.
      CAP_SETFCAP	Sets file capabilities.
      CAP_SETPCAP	If the file capabilities are not supported, grants or removes any capability in the caller's permitted capability set to or from any other process.
      CAP_NET_BIND_SERVICE	Binds a socket to internet domain privileged ports (port numbers less than 1024).
      CAP_SYS_CHROOT	Uses chroot(2) to change to a different root directory.
      CAP_KILL	Bypasses permission checks for sending signals, which includes use of the ioctl(2) KDSIGACCEPT operation.
      CAP_AUDIT_WRITE	Writes records to kernel auditing log.

7. Select Add.
8. To configure another container in the instance, select Add container and repeat the preceding steps.
9. Select Next to review the container instance and its containers.

1. Review your selections.
2. Select Edit to return to a section and change its configuration.
3. Select Create to create the container instance.

   Once the container instance is created, the container instance details page displays. See Container Instance Details.