{"id":748,"date":"2026-04-15T10:28:19","date_gmt":"2026-04-15T10:28:19","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-application-container-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-other-services\/"},"modified":"2026-04-15T10:28:19","modified_gmt":"2026-04-15T10:28:19","slug":"oracle-cloud-application-container-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-other-services","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-application-container-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-other-services\/","title":{"rendered":"Oracle Cloud Application Container Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Other Services"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Other Services<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p><strong>Important status note (read first):<\/strong> In Oracle\u2019s product history, the name <strong>Application Container<\/strong> most commonly refers to <strong>Oracle Application Container Cloud Service<\/strong>\u2014a managed PaaS offering from <strong>Oracle Cloud (Classic)<\/strong> used to run containerized applications. Oracle Cloud has since shifted its strategic container runtime offerings to <strong>Oracle Cloud Infrastructure (OCI)<\/strong> services such as <strong>OCI Container Instances<\/strong>, <strong>OCI Container Engine for Kubernetes (OKE)<\/strong>, and <strong>OCI Functions<\/strong>. Availability, onboarding, and pricing for the legacy service can vary by account and may no longer be offered for new customers. <strong>Verify current availability in official Oracle documentation and your Oracle Cloud account.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What this service is<\/h3>\n\n\n\n<p><strong>Application Container<\/strong> is (historically) Oracle Cloud\u2019s managed application runtime for deploying and running container-packaged applications without provisioning and managing servers directly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Simple explanation (one paragraph)<\/h3>\n\n\n\n<p>You package your application as a container image (or deploy it using supported runtime packaging), upload it to Oracle Cloud, and Oracle runs it for you\u2014handling the underlying compute, basic scaling patterns, and runtime operations so you can focus on code and releases.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Technical explanation (one paragraph)<\/h3>\n\n\n\n<p>Application Container (as Oracle Application Container Cloud Service in Oracle Cloud Classic) provided a managed container execution environment with deployment descriptors (for configuration), integration points to other Oracle Cloud services, and operational controls such as instance sizing, scaling settings, and logging\/monitoring hooks. In modern OCI, similar outcomes are achieved using <strong>OCI Container Instances<\/strong> (serverless-style container runtime), <strong>OKE<\/strong> (managed Kubernetes), and supporting services like <strong>OCI Registry (OCIR)<\/strong>, <strong>IAM<\/strong>, <strong>VCN<\/strong>, <strong>Logging<\/strong>, and <strong>Monitoring<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What problem it solves<\/h3>\n\n\n\n<p>Teams want to run containerized web APIs, background workers, and microservices <strong>without<\/strong>:\n&#8211; managing VMs, OS patching, and host-level Docker operations\n&#8211; maintaining a full Kubernetes control plane for small-to-medium workloads\n&#8211; building a bespoke deployment platform<\/p>\n\n\n\n<p>Application Container aimed to provide a \u201cdeploy containers, get an endpoint, operate safely\u201d experience in Oracle Cloud.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Application Container?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Official purpose<\/h3>\n\n\n\n<p>Historically, <strong>Application Container<\/strong> (Oracle Application Container Cloud Service) was designed to <strong>deploy and run applications packaged in containers<\/strong> in Oracle Cloud, supporting typical web\/service workloads with managed infrastructure.<\/p>\n\n\n\n<p>Because Oracle has evolved its cloud platform, <strong>the official purpose you should validate today<\/strong> is:\n&#8211; Whether <strong>Oracle Application Container Cloud Service<\/strong> is still available to your tenancy (legacy\/Classic), and\n&#8211; Which <strong>OCI-native services<\/strong> Oracle recommends for new deployments (typically <strong>OCI Container Instances<\/strong>, <strong>OKE<\/strong>, or <strong>Functions<\/strong>).<\/p>\n\n\n\n<p><strong>Verify in official docs:<\/strong>\n&#8211; Oracle Cloud Infrastructure documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/\n&#8211; Oracle Cloud pricing entry points: https:\/\/www.oracle.com\/cloud\/pricing\/ and https:\/\/www.oracle.com\/cloud\/costestimator.html<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (conceptually)<\/h3>\n\n\n\n<p>Depending on the generation of the service (Classic vs OCI-native alternatives), \u201cApplication Container\u201d style capabilities typically include:\n&#8211; Running container images as managed workloads\n&#8211; Configuring environment variables and application settings\n&#8211; Exposing HTTP(S) endpoints\n&#8211; Integrating with identity, networking, logs, and metrics\n&#8211; Supporting CI\/CD-driven deployments<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (how to think about it)<\/h3>\n\n\n\n<p>Even if the legacy service is not available, the <strong>functional components<\/strong> you\u2019ll use in Oracle Cloud to implement \u201cApplication Container\u201d outcomes are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Component<\/th>\n<th>What it does in Oracle Cloud<\/th>\n<th>Typical OCI service(s)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Container image repository<\/td>\n<td>Stores versioned container images<\/td>\n<td><strong>OCI Registry (OCIR)<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Runtime to execute containers<\/td>\n<td>Runs containers without managing servers<\/td>\n<td><strong>OCI Container Instances<\/strong> (or <strong>OKE<\/strong>)<\/td>\n<\/tr>\n<tr>\n<td>Networking<\/td>\n<td>Private networks, ingress, routing, security rules<\/td>\n<td><strong>VCN<\/strong>, subnets, security lists\/NSGs, <strong>Load Balancer<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Identity and permissions<\/td>\n<td>Who can push\/pull images and deploy runtimes<\/td>\n<td><strong>OCI IAM<\/strong> (policies, dynamic groups, auth tokens)<\/td>\n<\/tr>\n<tr>\n<td>Secrets<\/td>\n<td>Store credentials securely<\/td>\n<td><strong>OCI Vault<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Logs and metrics<\/td>\n<td>Centralize and search logs; view metrics\/alarms<\/td>\n<td><strong>OCI Logging<\/strong>, <strong>OCI Monitoring<\/strong>, <strong>Alarms<\/strong>, <strong>Events<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Build\/Deploy automation<\/td>\n<td>CI\/CD pipelines and artifacts<\/td>\n<td>OCI DevOps (verify), or external tools (GitHub Actions\/Jenkins)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Legacy Application Container (Classic): <strong>PaaS<\/strong> (platform-managed runtime)<\/li>\n<li>OCI-native replacement pattern: <strong>Managed container runtime<\/strong> (Container Instances) or <strong>Managed Kubernetes<\/strong> (OKE)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional\/global\/zonal scope<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI services used for the \u201cApplication Container\u201d pattern are generally <strong>regional<\/strong> resources (for example, VCN is regional; subnets may be regional in OCI; verify specifics per service).<\/li>\n<li>Identity (IAM) is <strong>tenancy-wide<\/strong>, with policies scoped via <strong>compartments<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>Think of Application Container as a <strong>runtime layer<\/strong>:\n&#8211; Above: your app code, CI\/CD, and deployment process\n&#8211; Beside: databases (Autonomous Database, MySQL), messaging\/streaming, API Gateway, Load Balancer\n&#8211; Below: VCN networking, IAM, logging\/monitoring, registry<\/p>\n\n\n\n<p>In OCI, a common modern mapping is:\n&#8211; <strong>OCIR<\/strong> (images) \u2192 <strong>Container Instances<\/strong> (runtime) \u2192 <strong>Load Balancer<\/strong> (ingress) \u2192 <strong>DB<\/strong>\/<strong>Object Storage<\/strong>\/<strong>Streaming<\/strong> (dependencies), all governed by <strong>IAM<\/strong> and observed with <strong>Logging\/Monitoring<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Application Container?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster time-to-market:<\/strong> deploy containerized apps without waiting for platform teams to provision and harden VM stacks.<\/li>\n<li><strong>Standardization:<\/strong> consistent deployment unit (container image) across dev\/test\/prod.<\/li>\n<li><strong>Reduced operational overhead:<\/strong> fewer moving parts than self-managed container hosts or bespoke platforms.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Immutable deployments:<\/strong> image-based releases improve repeatability and rollback strategies.<\/li>\n<li><strong>Portability:<\/strong> containers can move between environments (local Docker, CI, OCI runtime).<\/li>\n<li><strong>Dependency encapsulation:<\/strong> packages libraries and runtime dependencies consistently.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Simplified patching model:<\/strong> fewer host OS concerns (especially with managed runtimes).<\/li>\n<li><strong>Observability alignment:<\/strong> central logs\/metrics and alarms are easier to standardize.<\/li>\n<li><strong>Scalable patterns:<\/strong> scale out horizontally with multiple instances behind a load balancer (exact mechanics depend on the runtime service\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identity-driven access:<\/strong> IAM policies can restrict who can deploy, pull images, or view logs.<\/li>\n<li><strong>Network segmentation:<\/strong> run workloads in private subnets, use controlled ingress, and reduce public exposure.<\/li>\n<li><strong>Auditability:<\/strong> OCI Audit can record control plane actions (verify coverage for each service).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right-size quickly:<\/strong> choose CPU\/memory profiles appropriate for your service.<\/li>\n<li><strong>Elasticity patterns:<\/strong> add replicas\/instances and distribute traffic.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose an \u201cApplication Container\u201d approach in Oracle Cloud when you need:\n&#8211; A managed runtime for HTTP APIs, microservices, internal tools, and background workers\n&#8211; A container-based delivery model with minimal platform overhead\n&#8211; Clear separation of duties: developers ship images; ops govern IAM\/networking\/observability<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Avoid this approach (or choose a different OCI service) when:\n&#8211; You need <strong>full Kubernetes control<\/strong> (custom controllers, service mesh, complex scheduling) \u2192 consider <strong>OKE<\/strong>\n&#8211; You need <strong>event-driven\/serverless functions<\/strong> with per-request billing \u2192 consider <strong>OCI Functions<\/strong>\n&#8211; You require <strong>very specialized networking\/kernel capabilities<\/strong> or privileged containers \u2192 consider <strong>Compute<\/strong> or Kubernetes with careful governance\n&#8211; You are depending on <strong>Oracle Cloud Classic<\/strong> legacy services\u2014prefer OCI-native services for new builds (verify availability and support timelines)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Application Container used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS and software companies shipping microservices<\/li>\n<li>Finance and insurance for internal APIs and integration services<\/li>\n<li>Retail and e-commerce for web backends and campaign services<\/li>\n<li>Telecommunications for service mediation and API layers<\/li>\n<li>Healthcare for integration workloads (with strict security controls)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering teams offering a container runtime to application squads<\/li>\n<li>DevOps\/SRE teams standardizing CI\/CD and runtime operations<\/li>\n<li>Development teams who want containers but not Kubernetes complexity<\/li>\n<li>Security teams enforcing least privilege, private networking, and audit logging<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>REST\/gRPC APIs<\/li>\n<li>Web applications (frontend + backend)<\/li>\n<li>Background workers (queues, schedulers)<\/li>\n<li>ETL\/data ingestion microservices<\/li>\n<li>Integration adapters (calling ERP\/CRM systems)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Microservices behind a load balancer<\/li>\n<li>Three-tier app: web \u2192 API \u2192 database<\/li>\n<li>Event-driven pipelines (with streaming\/queues)<\/li>\n<li>Hybrid integration: on-prem systems connecting to OCI apps<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Production services with rolling releases, load balancing, and alarms<\/li>\n<li>Dev\/test sandboxes for feature branches<\/li>\n<li>Multi-environment setups (dev\/stage\/prod) using compartments and tagging<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dev\/test:<\/strong> smaller CPU\/memory, relaxed scaling, shorter retention for logs, frequent redeploys<\/li>\n<li><strong>Production:<\/strong> private subnets, WAF\/load balancer, strict IAM, alarms, on-call runbooks, and controlled outbound access<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic \u201cApplication Container\u201d style scenarios in Oracle Cloud. Where the legacy service is unavailable, implement them with <strong>OCI Container Instances<\/strong> or <strong>OKE<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Containerized REST API for a mobile app<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need a stable API backend with repeatable deployments.<\/li>\n<li><strong>Why this service fits:<\/strong> Container image release process is consistent; managed runtime reduces ops burden.<\/li>\n<li><strong>Scenario:<\/strong> A Node\/Java\/Python API is deployed as an image, fronted by an OCI Load Balancer and connected to Autonomous Database.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Internal admin portal<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Internal tools need secure access and rapid iteration.<\/li>\n<li><strong>Why it fits:<\/strong> Easy deployments; tight IAM and network controls.<\/li>\n<li><strong>Scenario:<\/strong> Admin UI runs in a private subnet; access is via VPN\/FastConnect and internal DNS.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Background worker processing queue messages<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Offload async tasks from the web tier.<\/li>\n<li><strong>Why it fits:<\/strong> Long-running container processes; scale workers by replicas.<\/li>\n<li><strong>Scenario:<\/strong> Workers pull jobs from a queue\/streaming service and write results to Object Storage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Webhook receiver for third-party integrations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You must receive inbound webhooks reliably and securely.<\/li>\n<li><strong>Why it fits:<\/strong> Expose a single endpoint; validate signatures; forward events internally.<\/li>\n<li><strong>Scenario:<\/strong> A small API service receives Stripe\/Git provider webhooks and publishes to a streaming topic.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Multi-tenant SaaS microservice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Tenant isolation and repeatable scaling are required.<\/li>\n<li><strong>Why it fits:<\/strong> Containers support consistent deployment; compartments\/tags support governance.<\/li>\n<li><strong>Scenario:<\/strong> Each environment runs multiple services; service-level alarms and dashboards track SLIs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Blue\/green or canary releases for a service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Reduce risk during releases.<\/li>\n<li><strong>Why it fits:<\/strong> Run two versions of the container and shift traffic gradually (often via Load Balancer).<\/li>\n<li><strong>Scenario:<\/strong> Deploy v2 alongside v1 and adjust LB routing (method depends on LB features\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Batch ingestion microservice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Periodically ingest data from external sources.<\/li>\n<li><strong>Why it fits:<\/strong> Containerized job can run on schedule via external scheduler or OCI Events\/Functions (verify).<\/li>\n<li><strong>Scenario:<\/strong> A container pulls CSV files from SFTP, transforms them, stores results in Object Storage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) API facade in front of legacy systems<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You need a modern API while backends are legacy.<\/li>\n<li><strong>Why it fits:<\/strong> Lightweight stateless API container; network connectivity to on-prem via FastConnect\/VPN.<\/li>\n<li><strong>Scenario:<\/strong> API validates JWT, maps requests to SOAP\/DB calls, returns normalized JSON.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) ML model inference microservice (lightweight)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Serve a small model with predictable latency.<\/li>\n<li><strong>Why it fits:<\/strong> Container packaging of runtime dependencies; can scale out.<\/li>\n<li><strong>Scenario:<\/strong> A FastAPI inference service runs in a container; autoscaling handled by platform patterns (verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Security scanner \/ policy agent sidecar pattern (platform-dependent)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Enforce policies at runtime.<\/li>\n<li><strong>Why it fits:<\/strong> Container platform can host policy agents; logs centralized.<\/li>\n<li><strong>Scenario:<\/strong> A policy service validates requests and emits audit logs (implementation depends on chosen runtime\u2014verify).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Because <strong>Application Container<\/strong> is widely associated with a <strong>legacy Oracle Cloud Classic<\/strong> service, the safest way to describe features is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Legacy features<\/strong> (what the Classic service typically provided)<\/li>\n<li><strong>OCI-native equivalents<\/strong> (how to achieve it today)<\/li>\n<\/ul>\n\n\n\n<p>If your account still uses the legacy service, <strong>verify exact capabilities in the Classic documentation available to you<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 1: Containerized deployment unit<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses a container image (or container-like packaging) as the deployable artifact.<\/li>\n<li><strong>Why it matters:<\/strong> Strong release consistency across environments.<\/li>\n<li><strong>Practical benefit:<\/strong> \u201cWorks on my machine\u201d issues are reduced.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> You must maintain image security (base image updates, CVE scanning).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 2: Managed runtime (no server management)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Runs containers without you managing host OS and Docker daemon operations.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces ops overhead and hardening tasks.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster deployments and fewer infrastructure tickets.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Less low-level control; some workloads requiring privileged access may not work.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 3: Configuration injection (env vars \/ deployment descriptors)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows configuration outside the image (environment variables, settings).<\/li>\n<li><strong>Why it matters:<\/strong> Promotes 12-factor app practices.<\/li>\n<li><strong>Practical benefit:<\/strong> Same image can be reused across dev\/stage\/prod.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Don\u2019t store secrets in plaintext env vars; use Vault\/secrets patterns.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 4: Service exposure (HTTP endpoint)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Exposes an application endpoint, often via a load balancer or platform routing.<\/li>\n<li><strong>Why it matters:<\/strong> Standard way to publish APIs.<\/li>\n<li><strong>Practical benefit:<\/strong> Predictable DNS and TLS termination patterns.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Network design matters; avoid direct public exposure when not required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 5: Horizontal scaling patterns<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports running multiple instances\/replicas.<\/li>\n<li><strong>Why it matters:<\/strong> Enables higher availability and throughput.<\/li>\n<li><strong>Practical benefit:<\/strong> Scale-out handles spikes better than vertical-only scaling.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Your app must be stateless (or externalize state to DB\/cache).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 6: Rolling deployments \/ versioning (pattern)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables replacing instances gradually (or running parallel versions).<\/li>\n<li><strong>Why it matters:<\/strong> Reduces downtime and release risk.<\/li>\n<li><strong>Practical benefit:<\/strong> Safer deploys with rollback options.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Exact deployment controls differ by runtime; verify.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 7: Logging integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Emits container logs to a centralized service.<\/li>\n<li><strong>Why it matters:<\/strong> Operational debugging and auditability.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster incident resolution.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Log volume can become a cost driver; set retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 8: Metrics and alarms integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Publishes runtime metrics (CPU\/memory, request rates if instrumented).<\/li>\n<li><strong>Why it matters:<\/strong> Alerts before outages.<\/li>\n<li><strong>Practical benefit:<\/strong> SRE-grade visibility when combined with SLIs\/SLOs.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> App-level metrics require instrumentation (Prometheus\/OpenTelemetry patterns\u2014verify supported integrations).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 9: IAM-controlled access to images and deployment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Restricts who can push images, deploy runtimes, and view logs.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents unauthorized releases and supply-chain issues.<\/li>\n<li><strong>Practical benefit:<\/strong> Enforce least privilege and separation of duties.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Misconfigured policies are a common failure mode.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 10: Network isolation and private connectivity (with OCI patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Runs workloads inside a VCN with private subnets and controlled ingress\/egress.<\/li>\n<li><strong>Why it matters:<\/strong> Supports compliance and reduces attack surface.<\/li>\n<li><strong>Practical benefit:<\/strong> Private services can still be reachable via API Gateway\/LB.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Requires careful subnet, route table, and security list\/NSG configuration.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>An \u201cApplication Container\u201d architecture in Oracle Cloud typically looks like:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Developers build a container image.<\/li>\n<li>The image is pushed to <strong>OCI Registry (OCIR)<\/strong>.<\/li>\n<li>A managed runtime (legacy Application Container service or modern OCI Container Instances\/OKE) pulls the image.<\/li>\n<li>Networking controls expose the app:\n   &#8211; private-only service, or\n   &#8211; public endpoint via <strong>OCI Load Balancer<\/strong> (optionally with WAF\/API Gateway\u2014verify).<\/li>\n<li>Observability services collect logs\/metrics; IAM and Audit govern changes.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Request \/ data \/ control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane flow:<\/strong> Console\/CLI\/API \u2192 IAM auth \u2192 runtime service creates\/updates deployments \u2192 pulls image from registry.<\/li>\n<li><strong>Data plane flow:<\/strong> Client \u2192 DNS \u2192 Load Balancer \u2192 container runtime \u2192 downstream dependencies (DB\/Object Storage\/Streaming).<\/li>\n<li><strong>Telemetry flow:<\/strong> Container stdout\/stderr \u2192 Logging; system\/app metrics \u2192 Monitoring \u2192 Alarms\/Notifications.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services (common)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Registry (OCIR):<\/strong> container images<\/li>\n<li><strong>VCN:<\/strong> network segmentation<\/li>\n<li><strong>Load Balancer:<\/strong> stable ingress, TLS termination<\/li>\n<li><strong>API Gateway (optional):<\/strong> API management, auth offload (verify)<\/li>\n<li><strong>Vault:<\/strong> secrets management<\/li>\n<li><strong>Logging \/ Monitoring \/ Alarms:<\/strong> ops<\/li>\n<li><strong>Notifications:<\/strong> send alarm notifications<\/li>\n<li><strong>Audit:<\/strong> track administrative actions<\/li>\n<li><strong>Autonomous Database \/ MySQL \/ Object Storage:<\/strong> data dependencies<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>At minimum for OCI-native runtime patterns:\n&#8211; OCI IAM\n&#8211; VCN + subnet + security rules\n&#8211; OCIR (or a public registry)\n&#8211; Logging\/Monitoring (recommended)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Users and groups<\/strong> are managed in OCI IAM.<\/li>\n<li>Access is controlled via <strong>policies<\/strong> scoped to compartments.<\/li>\n<li>Pushing images to OCIR commonly uses <strong>auth tokens<\/strong> (for Docker login) tied to a user, or automation-friendly credentials (verify best practice for your org).<\/li>\n<li>Runtime pulling from OCIR must have permission; depending on the runtime, this can be via service principals\/dynamic groups or configuration (verify).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Runtime resources attach to a subnet in a VCN.<\/li>\n<li>Ingress is allowed via security list\/NSG rules (ports like 80\/443\/8080).<\/li>\n<li>For production:<\/li>\n<li>prefer <strong>private subnets<\/strong> for workloads<\/li>\n<li>terminate TLS at a Load Balancer<\/li>\n<li>use controlled egress (NAT Gateway) for outbound internet access if required<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use compartments for environment separation (dev\/stage\/prod).<\/li>\n<li>Apply tags (cost center, app name, owner, environment).<\/li>\n<li>Enable Logging for container logs (verify per service).<\/li>\n<li>Create alarms for:<\/li>\n<li>runtime health\/availability<\/li>\n<li>high CPU\/memory<\/li>\n<li>high 5xx from LB<\/li>\n<li>Track deployments via Audit and CI\/CD.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Dev[Developer Laptop \/ CI] --&gt;|docker build| Img[Container Image]\n  Img --&gt;|push| OCIR[(OCI Registry - OCIR)]\n  OCIR --&gt;|pull| Runtime[Application Container Runtime]\n  User[Client] --&gt;|HTTPS| LB[Load Balancer]\n  LB --&gt; Runtime\n  Runtime --&gt; DB[(Database)]\n  Runtime --&gt; Logs[Logging\/Monitoring]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (OCI-native implementation)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph \"OCI Tenancy\"\n    subgraph \"Compartment: prod\"\n      OCIR[(OCIR Repo)]\n      Vault[(OCI Vault)]\n      Log[(OCI Logging)]\n      Mon[(OCI Monitoring\/Alarms)]\n      Audit[(OCI Audit)]\n\n      subgraph \"VCN\"\n        subgraph \"Public Subnet\"\n          LB[OCI Load Balancer\\nTLS Termination]\n          WAF[WAF \/ API Gateway (optional)\\nVerify in docs]\n        end\n        subgraph \"Private Subnet\"\n          RT[Container Runtime\\n(OCI Container Instances or OKE)]\n          NAT[NAT Gateway (optional)]\n        end\n        DB[(Autonomous DB \/ DB System)]\n      end\n    end\n  end\n\n  Internet[Internet Clients] --&gt; WAF --&gt; LB --&gt; RT\n  RT --&gt; DB\n  RT --&gt; Vault\n  RT --&gt; Log\n  RT --&gt; Mon\n  Console[OCI Console\/CI-CD] --&gt;|Deploy\/Update| RT\n  Console --&gt; OCIR\n  Audit &lt;-- Console\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Because of the legacy vs OCI-native split, prerequisites are listed in two parts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A) If you are using legacy Oracle Cloud Classic \u201cApplication Container\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An Oracle Cloud Classic account\/identity domain with the service enabled<\/li>\n<li>Permissions to deploy applications and view logs<\/li>\n<li>Access to the Classic console and documentation available to your account<\/li>\n<li><strong>Verify in official docs<\/strong> for Classic service onboarding (availability varies)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">B) For the executable lab in this tutorial (OCI-native \u201cApplication Container\u201d pattern)<\/h3>\n\n\n\n<p>You\u2019ll implement \u201cApplication Container\u201d outcomes using <strong>OCI Container Instances<\/strong> + <strong>OCIR<\/strong>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Account\/tenancy requirements<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>Oracle Cloud (OCI)<\/strong> tenancy with access to:<\/li>\n<li>OCI Registry (OCIR)<\/li>\n<li>Container runtime service (commonly <strong>OCI Container Instances<\/strong>; verify region availability)<\/li>\n<li>Networking (VCN)<\/li>\n<li>Logging\/Monitoring<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Permissions \/ IAM<\/h4>\n\n\n\n<p>You need permissions to:\n&#8211; create and manage repositories in OCIR\n&#8211; create and manage networking (VCN\/subnets\/security rules)\n&#8211; create and manage container instances (or equivalent runtime resources)\n&#8211; view logs<\/p>\n\n\n\n<p>If you are not an admin, ask for a compartment-level policy set that allows those actions. <strong>Exact policy statements depend on your org model and the chosen runtime\u2014verify with OCI IAM docs.<\/strong><\/p>\n\n\n\n<p>OCI IAM docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Billing requirements<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A paid tenancy or trial with billing enabled may be required.<\/li>\n<li>OCI has an <strong>Always Free<\/strong> program, but not every service is Always Free in every region. <strong>Verify current eligibility<\/strong>:<\/li>\n<li>https:\/\/www.oracle.com\/cloud\/free\/<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">CLI\/SDK\/tools<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Docker (or compatible container engine) locally<\/li>\n<li>Optional: OCI CLI (useful for automation, not required for the lab)<\/li>\n<li>OCI CLI docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<li>A code editor<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Region availability<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choose an OCI region where OCIR and the selected container runtime service are available.<\/li>\n<li>If \u201cContainer Instances\u201d is not available in your region\/tenancy, use <strong>OKE<\/strong> or <strong>Compute + Docker<\/strong> as an alternative (not identical, but executable).<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Quotas\/limits<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Service limits may restrict number of container instances, VCNs, or load balancers.<\/li>\n<li>Check: OCI Console \u2192 Governance \u2192 Limits, Quotas (naming may vary\u2014verify).<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Prerequisite services<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VCN with subnet(s)<\/li>\n<li>OCIR repository (or a public registry image)<\/li>\n<li>Logging (recommended)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Current pricing model (how to think about it)<\/h3>\n\n\n\n<p>Because <strong>Application Container<\/strong> is widely associated with a <strong>legacy Oracle Cloud Classic<\/strong> service, pricing can be confusing:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Legacy (Classic) Application Container pricing:<\/strong> historically offered in metered\/non-metered models. <strong>Do not assume those SKUs are still purchasable or publicly listed. Verify in your Oracle contract and Classic pricing references available to your account.<\/strong><\/li>\n<li><strong>OCI-native approach pricing:<\/strong> you pay for the OCI services you use:<\/li>\n<li>Container runtime (CPU\/memory time)<\/li>\n<li>Networking (Load Balancer, outbound data transfer)<\/li>\n<li>Registry storage and requests<\/li>\n<li>Logging ingestion and retention (depending on configuration)<\/li>\n<li>Any dependent data services (DB, Object Storage, Streaming)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing sources (start here)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud Pricing: https:\/\/www.oracle.com\/cloud\/pricing\/<\/li>\n<li>Oracle Cloud Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/li>\n<li>OCI Price List (often linked from pricing pages): https:\/\/www.oracle.com\/cloud\/price-list\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (OCI-native \u201cApplication Container\u201d pattern)<\/h3>\n\n\n\n<p>The exact dimensions vary by service and region, but commonly include:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Compute for container runtime<\/strong>\n   &#8211; Billed by allocated CPU (OCPU\/vCPU) and memory per time unit\n   &#8211; Some runtimes may bill for provisioned capacity even when idle (verify)<\/p>\n<\/li>\n<li>\n<p><strong>Load Balancer<\/strong>\n   &#8211; Hourly LB cost + bandwidth\/LCU-style usage (model varies\u2014verify in OCI LB pricing)<\/p>\n<\/li>\n<li>\n<p><strong>Container registry (OCIR)<\/strong>\n   &#8211; Storage used by images\n   &#8211; Data transfer when pulling\/pushing images (especially cross-region)\n   &#8211; Requests\/operations may be priced (verify)<\/p>\n<\/li>\n<li>\n<p><strong>Logging and Monitoring<\/strong>\n   &#8211; Log ingestion volume and retention can cost money depending on SKU\/config\n   &#8211; Metrics\/alarm features may have free quotas; verify<\/p>\n<\/li>\n<li>\n<p><strong>Network egress<\/strong>\n   &#8211; Outbound data transfer to the internet is often a meaningful cost driver\n   &#8211; Cross-region data transfer can also cost money<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Free tier considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Free Tier: https:\/\/www.oracle.com\/cloud\/free\/<\/li>\n<li>Free eligibility varies by region and service. <strong>Confirm whether Container Instances and Load Balancer usage is included or discounted.<\/strong><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Key cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always-on workloads with high CPU\/memory allocation<\/li>\n<li>Public-facing services with high outbound bandwidth<\/li>\n<li>Frequent deployments pulling large images repeatedly<\/li>\n<li>High-volume logs (debug logging in production)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CI\/CD runners<\/strong> (if self-hosted) and build minutes (if using external platforms)<\/li>\n<li><strong>Image storage growth<\/strong> from unpruned tags<\/li>\n<li><strong>Vulnerability scanning<\/strong> tooling (if not included) and operational overhead<\/li>\n<li><strong>Data services<\/strong> (DB, cache) often dominate runtime costs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep container runtime and database in the same region to avoid cross-region data charges and latency.<\/li>\n<li>Consider private endpoints and avoid routing internal traffic over the public internet.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size CPU\/memory; measure before scaling up.<\/li>\n<li>Use autoscaling only where it truly reduces cost (some models scale capacity up but do not reduce to zero\u2014verify).<\/li>\n<li>Keep images small (multi-stage builds, slim base images).<\/li>\n<li>Reduce log verbosity; set retention policies.<\/li>\n<li>Use private networking to avoid unnecessary egress.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A minimal starter setup typically includes:\n&#8211; 1 small container runtime instance (low CPU\/memory)\n&#8211; No load balancer (direct test endpoint) or a single small LB (if required)\n&#8211; Small OCIR repository with one image\n&#8211; Basic logging<\/p>\n\n\n\n<p>Because prices vary by region and service SKU, use:\n&#8211; OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<br\/>\nSelect your region, then add:\n&#8211; Container runtime service (Container Instances or OKE worker nodes)\n&#8211; Load Balancer (if used)\n&#8211; OCIR storage estimate (e.g., a few GB)\n&#8211; Expected outbound bandwidth (GB\/month)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, cost is usually dominated by:\n&#8211; multiple replicas for availability\n&#8211; a load balancer (often required)\n&#8211; outbound data transfer\n&#8211; database tier and storage\/IO\n&#8211; logging volume and retention\n&#8211; non-prod environments that are left running 24\/7<\/p>\n\n\n\n<p>A practical governance approach:\n&#8211; Tag all resources with <code>environment<\/code>, <code>application<\/code>, <code>owner<\/code>, <code>cost-center<\/code>\n&#8211; Use budgets and alerts (OCI Budgets\u2014verify service availability)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab shows a <strong>modern, executable<\/strong> \u201cApplication Container\u201d deployment pattern on <strong>Oracle Cloud (OCI)<\/strong> using:\n&#8211; <strong>OCI Registry (OCIR)<\/strong> to store your image\n&#8211; <strong>OCI Container Instances<\/strong> to run the container (or the closest equivalent available in your tenancy)<\/p>\n\n\n\n<p>If <strong>OCI Container Instances<\/strong> is not available in your region\/tenancy, use <strong>OKE<\/strong> (more complex) or <strong>Compute + Docker<\/strong> (more manual). The image build\/push steps still apply.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Build and deploy a small containerized web API (\u201chello\u201d) to Oracle Cloud so it runs as a managed container workload and is reachable over HTTP for validation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create (or choose) an OCI compartment and network (VCN + subnet).\n2. Create an OCIR repository and push a container image.\n3. Deploy the image to a managed container runtime (OCI Container Instances).\n4. Validate the service endpoint and view logs.\n5. Clean up resources to avoid ongoing charges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Prepare your OCI compartment and region<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the <strong>OCI Console<\/strong>.<\/li>\n<li>Choose the <strong>region<\/strong> you will use (top-right region selector).<\/li>\n<li>Create or select a <strong>compartment<\/strong> for the lab, for example: <code>lab-application-container<\/code>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a compartment to isolate resources and costs.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can see the compartment in the compartment selector.\n&#8211; You have permission to create networking and registry resources in it.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VCN and a public subnet (for a simple demo)<\/h3>\n\n\n\n<p>For a beginner-friendly demo, use a VCN with a public subnet so you can test from your laptop. For production, prefer a private subnet + load balancer.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In OCI Console, go to Networking \u2192 <strong>Virtual Cloud Networks<\/strong>.<\/li>\n<li>Create VCN.<\/li>\n<li>Choose <strong>VCN with Internet Connectivity<\/strong> (wizard naming may vary; verify).<\/li>\n<li>Ensure you get:\n   &#8211; a VCN\n   &#8211; an <strong>Internet Gateway<\/strong>\n   &#8211; a <strong>public subnet<\/strong>\n   &#8211; a route table that routes <code>0.0.0.0\/0<\/code> to the Internet Gateway<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A VCN exists with a public subnet capable of inbound\/outbound internet connectivity.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Subnet is marked public (or has route via Internet Gateway).\n&#8211; Route table includes <code>0.0.0.0\/0 -&gt; Internet Gateway<\/code>.<\/p>\n\n\n\n<p><strong>Security rule setup (important):<\/strong>\n&#8211; Add an ingress rule (Security List or NSG depending on your design) to allow TCP <strong>8080<\/strong> from your IP for the lab:\n  &#8211; Source: <code>your-public-ip\/32<\/code> (recommended)<br\/>\n  &#8211; Destination port: <code>8080<\/code>\n  &#8211; Protocol: TCP<\/p>\n\n\n\n<p>If you cannot restrict to your IP, use <code>0.0.0.0\/0<\/code> temporarily <strong>only for this lab<\/strong>, then remove it.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Network rules allow inbound access to port 8080.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create an OCIR repository<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In OCI Console, navigate to <strong>Developer Services<\/strong> \u2192 <strong>Container Registry (OCIR)<\/strong> (menu names vary; you can also search for \u201cRegistry\u201d).<\/li>\n<li>Create a new repository, for example:\n   &#8211; Repository name: <code>hello-application-container<\/code>\n   &#8211; Visibility: <strong>Private<\/strong> (recommended)<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A private OCIR repository exists.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Repository shows up in OCIR with an empty tag list initially.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create an Auth Token for OCIR (for Docker login)<\/h3>\n\n\n\n<p>OCIR commonly uses an <strong>Auth Token<\/strong> for Docker CLI authentication.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to Profile \u2192 User settings (top-right user menu).<\/li>\n<li>Find <strong>Auth Tokens<\/strong>.<\/li>\n<li>Generate a new token (save it securely; you typically can\u2019t view it again).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have an auth token string.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Token appears in your Auth Tokens list.<\/p>\n\n\n\n<p><strong>Security note:<\/strong> Treat auth tokens like passwords. Prefer short-lived tokens and least privilege.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Build a tiny web app and container image locally<\/h3>\n\n\n\n<p>Create a folder <code>hello-app<\/code> with two files.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><code>app.py<\/code><\/h4>\n\n\n\n<pre><code class=\"language-python\">from flask import Flask\nimport os\n\napp = Flask(__name__)\n\n@app.get(\"\/\")\ndef hello():\n    name = os.getenv(\"NAME\", \"Oracle Cloud\")\n    return {\"message\": f\"Hello from Application Container pattern on {name}!\"}\n\nif __name__ == \"__main__\":\n    # Container Instances typically expects you to bind to 0.0.0.0\n    app.run(host=\"0.0.0.0\", port=8080)\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><code>requirements.txt<\/code><\/h4>\n\n\n\n<pre><code class=\"language-text\">flask==3.0.3\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><code>Dockerfile<\/code><\/h4>\n\n\n\n<pre><code class=\"language-dockerfile\">FROM python:3.12-slim\n\nWORKDIR \/app\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\n\nCOPY app.py .\n\nENV PORT=8080\nEXPOSE 8080\n\nCMD [\"python\", \"app.py\"]\n<\/code><\/pre>\n\n\n\n<p>Build the image:<\/p>\n\n\n\n<pre><code class=\"language-bash\">cd hello-app\ndocker build -t hello-application-container:1.0 .\n<\/code><\/pre>\n\n\n\n<p>Run locally to confirm:<\/p>\n\n\n\n<pre><code class=\"language-bash\">docker run --rm -p 8080:8080 -e NAME=\"Oracle Cloud\" hello-application-container:1.0\n<\/code><\/pre>\n\n\n\n<p>Test:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl http:\/\/localhost:8080\/\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; You receive a JSON response like:\n  &#8211; <code>{\"message\":\"Hello from Application Container pattern on Oracle Cloud!\"}<\/code><\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; The container logs show Flask listening on <code>0.0.0.0:8080<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Log in to OCIR and push the image<\/h3>\n\n\n\n<p>OCIR registry endpoints are region-specific and tenancy-specific. The exact registry URL format can vary (for example, includes a region key and tenancy namespace). <strong>Use the OCIR console \u201cView Login Instructions\u201d (or similar) to get the exact commands for your region.<\/strong><\/p>\n\n\n\n<p>Typical flow:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Get your OCIR namespace (shown in the OCIR console).<\/li>\n<li>Identify the OCIR registry endpoint for your region (shown in login instructions).<\/li>\n<li>Docker login using:\n   &#8211; Username: often in the form <code>tenancy-namespace\/oracleidentitycloudservice\/your.user@company.com<\/code> (format varies\u2014verify)\n   &#8211; Password: the auth token you created<\/li>\n<\/ol>\n\n\n\n<p>Example pattern (VERIFY and replace with your values):<\/p>\n\n\n\n<pre><code class=\"language-bash\">docker login &lt;region-key&gt;.ocir.io\n<\/code><\/pre>\n\n\n\n<p>Tag your image for OCIR (VERIFY registry\/namespace\/repo):<\/p>\n\n\n\n<pre><code class=\"language-bash\">docker tag hello-application-container:1.0 &lt;region-key&gt;.ocir.io\/&lt;ocir-namespace&gt;\/hello-application-container:1.0\n<\/code><\/pre>\n\n\n\n<p>Push:<\/p>\n\n\n\n<pre><code class=\"language-bash\">docker push &lt;region-key&gt;.ocir.io\/&lt;ocir-namespace&gt;\/hello-application-container:1.0\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> The image is uploaded and visible in OCIR with tag <code>1.0<\/code>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; In OCIR console, open the repository and confirm the tag is present.\n&#8211; The image size and digest are shown.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Deploy the image to OCI Container Instances (runtime)<\/h3>\n\n\n\n<p>Console navigation varies; use the search bar for <strong>\u201cContainer Instances\u201d<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Container Instances<\/strong>.<\/li>\n<li>Create a new container instance with:\n   &#8211; Compartment: <code>lab-application-container<\/code>\n   &#8211; Name: <code>hello-ci-1<\/code>\n   &#8211; VCN\/subnet: select your public subnet created earlier\n   &#8211; Image source: <strong>OCIR<\/strong> and select your repository\/tag\n   &#8211; Container port: <code>8080<\/code>\n   &#8211; Environment variables:<ul>\n<li><code>NAME=Oracle Cloud<\/code><\/li>\n<li>Public IP:<\/li>\n<li>Enable if you want direct public testing (lab only)<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A container instance is created and transitions to a running\/active state.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Container instance lifecycle state is \u201cRunning\u201d (wording may differ).\n&#8211; It shows an assigned private IP and (if enabled) a public IP.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Test the deployed service<\/h3>\n\n\n\n<p>If you enabled a public IP, test it:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl http:\/\/&lt;PUBLIC_IP&gt;:8080\/\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> You receive the same JSON message from Oracle Cloud.<\/p>\n\n\n\n<p><strong>Verification checklist:<\/strong>\n&#8211; HTTP 200 response\n&#8211; Correct JSON payload\n&#8211; Container instance metrics\/logs show activity (if enabled)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: View logs (and confirm operational visibility)<\/h3>\n\n\n\n<p>Depending on your setup, you may:\n&#8211; view logs in the container instance details page, or\n&#8211; configure OCI Logging to collect container logs<\/p>\n\n\n\n<p>Check:\n&#8211; OCI Console \u2192 Logging \u2192 Log Explorer (if configured)\n&#8211; Container instance details \u2192 Logs (if present)<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can see request logs and application startup logs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>You have successfully implemented an \u201cApplication Container\u201d runtime pattern on Oracle Cloud if:\n&#8211; The container image exists in OCIR\n&#8211; The container runtime is running the image\n&#8211; You can <code>curl<\/code> the endpoint and receive a valid response\n&#8211; You can access logs for basic troubleshooting<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: <code>docker login<\/code> fails (401 Unauthorized)<\/h4>\n\n\n\n<p><strong>Common causes<\/strong>\n&#8211; Using your OCI console password instead of an Auth Token\n&#8211; Wrong OCIR endpoint\/region key\n&#8211; Wrong username format<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Re-check OCIR \u201clogin instructions\u201d in the console\n&#8211; Create a new Auth Token and retry\n&#8211; Confirm your user has permissions to access OCIR in the compartment\/tenancy<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Push succeeds, but runtime can\u2019t pull image<\/h4>\n\n\n\n<p><strong>Common causes<\/strong>\n&#8211; Repository is private and runtime lacks permission\n&#8211; Incorrect image tag specified\n&#8211; Network egress blocked<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Verify repository visibility and IAM permissions\n&#8211; Confirm the exact image reference\n&#8211; Ensure the runtime subnet has required routing (and NAT\/IGW if needed)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: <code>curl<\/code> times out<\/h4>\n\n\n\n<p><strong>Common causes<\/strong>\n&#8211; Ingress rule missing for port 8080\n&#8211; Public IP not enabled\n&#8211; App bound to <code>127.0.0.1<\/code> instead of <code>0.0.0.0<\/code><\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Add\/verify security list or NSG rule for TCP 8080\n&#8211; Confirm the runtime has a public IP for direct testing\n&#8211; Ensure app listens on <code>0.0.0.0<\/code> (as in this lab)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Container starts then stops<\/h4>\n\n\n\n<p><strong>Common causes<\/strong>\n&#8211; App crashes due to missing dependencies\n&#8211; Wrong command\/port\n&#8211; Not enough memory<\/p>\n\n\n\n<p><strong>Fix<\/strong>\n&#8211; Review container logs\n&#8211; Run the same container locally\n&#8211; Increase memory allocation (and then optimize later)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid charges, delete resources created in this lab:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Delete the <strong>container instance<\/strong>.<\/li>\n<li>Delete the <strong>OCIR repository<\/strong> (and images).<\/li>\n<li>Delete the <strong>VCN<\/strong> (wizard-created VCN deletion typically removes sub-resources; verify dependencies).<\/li>\n<li>Delete any <strong>log groups\/logs<\/strong> created specifically for the lab.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> No billable resources remain for the tutorial.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>stateless<\/strong> services; store state in managed services (DB, Object Storage).<\/li>\n<li>Put production workloads in <strong>private subnets<\/strong>; use a Load Balancer for ingress.<\/li>\n<li>Design for <strong>multi-AZ\/AD<\/strong> patterns where applicable (OCI constructs vary; verify per region\/service).<\/li>\n<li>Use <strong>health checks<\/strong> and graceful shutdown in your app.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use least-privilege IAM policies scoped to compartments.<\/li>\n<li>Separate duties:<\/li>\n<li>developers can push images to specific repos<\/li>\n<li>platform team controls runtime creation and networking<\/li>\n<li>Rotate auth tokens and credentials regularly.<\/li>\n<li>Use <strong>dynamic groups<\/strong> and instance principals\/service principals where possible (verify support for your runtime service).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size CPU\/memory; start small and measure.<\/li>\n<li>Remove unused images\/tags in OCIR (lifecycle policies if available\u2014verify).<\/li>\n<li>Use budgets\/alerts and tags for chargeback.<\/li>\n<li>Avoid excessive logging; set retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use small images; multi-stage builds.<\/li>\n<li>Cache dependencies at build time.<\/li>\n<li>Add app-level metrics (OpenTelemetry\/Prometheus patterns) and track latency\/throughput.<\/li>\n<li>Use connection pooling for DB access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Run multiple replicas behind a load balancer for critical services.<\/li>\n<li>Implement retries with backoff for downstream calls.<\/li>\n<li>Use timeouts and circuit breakers.<\/li>\n<li>Keep deployments reversible (version tags, rollback playbook).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralize logs and standardize log fields (service name, version, request-id).<\/li>\n<li>Set alarms on:<\/li>\n<li>container restarts\/crash loops<\/li>\n<li>high latency \/ 5xx at the edge<\/li>\n<li>CPU\/memory saturation<\/li>\n<li>Create runbooks for common failures (image pull errors, network rules, quota limits).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Naming:<\/li>\n<li><code>env-app-component<\/code> (e.g., <code>prod-payments-api<\/code>)<\/li>\n<li>Tags:<\/li>\n<li><code>environment=dev|stage|prod<\/code><\/li>\n<li><code>application=hello<\/code><\/li>\n<li><code>owner=email\/team<\/code><\/li>\n<li><code>cost-center=...<\/code><\/li>\n<li>Use compartments per environment and per team for clarity and blast-radius control.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI uses <strong>IAM policies<\/strong> evaluated against <strong>groups<\/strong>, <strong>dynamic groups<\/strong>, and <strong>resource principals<\/strong>.<\/li>\n<li>Control access to:<\/li>\n<li>OCIR repositories (push\/pull)<\/li>\n<li>runtime creation\/update<\/li>\n<li>logs and metrics visibility<\/li>\n<li>Prefer automation identities for CI\/CD rather than personal user accounts.<\/li>\n<\/ul>\n\n\n\n<p>IAM docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data at rest encryption is generally provided by OCI for managed services (verify per service).<\/li>\n<li>Data in transit:<\/li>\n<li>Use TLS end-to-end where possible<\/li>\n<li>Terminate TLS at an OCI Load Balancer for simpler cert management (or use mTLS patterns if required\u2014verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid public IPs in production.<\/li>\n<li>Use:<\/li>\n<li>private subnets for workloads<\/li>\n<li>Load Balancer\/WAF\/API Gateway for ingress control<\/li>\n<li>tightly scoped security rules (source IP restrictions)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<p>Common mistakes:\n&#8211; baking secrets into container images\n&#8211; putting secrets directly into environment variables stored in plaintext configs<\/p>\n\n\n\n<p>Recommendations:\n&#8211; Use <strong>OCI Vault<\/strong> for secrets, keys, and certificates.\n&#8211; Inject secrets at runtime using a supported secret delivery method (depends on runtime; verify).\n&#8211; Rotate secrets and audit access.<\/p>\n\n\n\n<p>Vault docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable <strong>OCI Audit<\/strong> (generally enabled by default for OCI API calls; verify) and review:<\/li>\n<li>who deployed<\/li>\n<li>what changed<\/li>\n<li>when changes occurred<\/li>\n<\/ul>\n\n\n\n<p>Audit docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm<br\/>\nLogging docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Logging\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure data residency requirements are met by choosing the correct region.<\/li>\n<li>Use compartment separation and IAM controls to enforce environment boundaries.<\/li>\n<li>For regulated workloads, document:<\/li>\n<li>encryption controls<\/li>\n<li>access reviews<\/li>\n<li>logging retention<\/li>\n<li>incident response procedures<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use signed images or provenance where possible (tooling-dependent; verify OCI support).<\/li>\n<li>Scan images for vulnerabilities in CI (and optionally in registry if supported\u2014verify).<\/li>\n<li>Use minimal base images and pinned versions.<\/li>\n<li>Run as non-root in containers where possible.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Legacy ambiguity:<\/strong> \u201cApplication Container\u201d often refers to a <strong>Classic<\/strong> service that may be retired or unavailable for new accounts.<\/li>\n<li><strong>Feature variance by runtime:<\/strong> OCI Container Instances vs OKE vs Compute+Docker have different capabilities and operational responsibilities.<\/li>\n<li><strong>Ingress design:<\/strong> Direct public IP testing is easy, but production-grade ingress usually needs a Load Balancer and careful security controls.<\/li>\n<li><strong>Stateful workloads:<\/strong> Containers are best for stateless services; persistent disks and state introduce complexity (use DB\/Object Storage).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Limits can block creation of:<\/li>\n<li>container instances<\/li>\n<li>VCNs\/subnets<\/li>\n<li>load balancers<\/li>\n<li>public IPs<br\/>\nCheck limits in OCI Console (Governance).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not every OCI service is available in every region.<\/li>\n<li>Some features arrive region-by-region. Always verify the region\u2019s service availability.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Load balancers and outbound bandwidth can dwarf compute costs.<\/li>\n<li>Logging ingestion\/retention can become expensive at scale if not controlled.<\/li>\n<li>Pulling large images repeatedly (especially cross-region) can increase network cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Containers requiring privileged mode, special kernel modules, or host networking may not run in managed runtimes.<\/li>\n<li>Some runtimes restrict writable filesystem paths; design apps accordingly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Misconfigured security lists\/NSGs are the #1 reason endpoints \u201cdon\u2019t work\u201d.<\/li>\n<li>Image pull failures often trace back to IAM permissions or wrong OCIR reference.<\/li>\n<li>Large images slow deployments; keep them lean.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<p>If you\u2019re migrating from Oracle Cloud Classic \u201cApplication Container\u201d:\n&#8211; Expect changes in identity model (Classic identity domain vs OCI IAM\/compartments).\n&#8211; Networking models differ; plan VCN\/subnet and routing carefully.\n&#8211; Rebuild CI\/CD pipelines to target OCIR and OCI runtime APIs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Options to consider<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Within Oracle Cloud (OCI):<\/strong><\/li>\n<li>OCI Container Instances (closest \u201crun my container\u201d experience)<\/li>\n<li>OCI Container Engine for Kubernetes (OKE)<\/li>\n<li>OCI Functions<\/li>\n<li>OCI Compute + self-managed Docker<\/li>\n<li><strong>Other clouds:<\/strong><\/li>\n<li>AWS App Runner, ECS\/Fargate<\/li>\n<li>Azure Container Apps \/ AKS<\/li>\n<li>Google Cloud Run \/ GKE<\/li>\n<li><strong>Open-source\/self-managed:<\/strong><\/li>\n<li>Kubernetes (self-managed)<\/li>\n<li>Nomad<\/li>\n<li>Docker Swarm (less common)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud \u2013 Application Container (Classic legacy)<\/strong><\/td>\n<td>Existing Classic customers<\/td>\n<td>PaaS-style simplicity (historically)<\/td>\n<td>May be legacy\/retired; limited new adoption<\/td>\n<td>Only if your org already uses it and it\u2019s still supported for you<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Container Instances<\/strong><\/td>\n<td>Simple containerized services without Kubernetes<\/td>\n<td>Minimal ops; quick deploy; integrates with OCI IAM\/VCN<\/td>\n<td>Less control than Kubernetes; feature set depends on service<\/td>\n<td>Default choice for \u201crun a container\u201d on OCI if available<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Container Engine for Kubernetes (OKE)<\/strong><\/td>\n<td>Platform teams, complex microservices, Kubernetes ecosystem<\/td>\n<td>Kubernetes flexibility; ecosystem tools; advanced scheduling<\/td>\n<td>Operational complexity; cluster management<\/td>\n<td>Choose when you need Kubernetes primitives and integrations<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Functions<\/strong><\/td>\n<td>Event-driven workloads, spiky traffic<\/td>\n<td>Serverless model; per-invocation patterns<\/td>\n<td>Runtime\/time limits; not ideal for long-running services<\/td>\n<td>Choose for async\/event-based execution<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Compute + Docker<\/strong><\/td>\n<td>Maximum control, specialized workloads<\/td>\n<td>Full OS control; broad compatibility<\/td>\n<td>You manage patching, scaling, host security<\/td>\n<td>Choose when managed runtimes don\u2019t support your needs<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS App Runner \/ ECS Fargate<\/strong><\/td>\n<td>Managed containers on AWS<\/td>\n<td>Mature ecosystem; multiple runtime choices<\/td>\n<td>Vendor differences; networking\/IAM changes<\/td>\n<td>Choose if workloads are primarily AWS-based<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Container Apps<\/strong><\/td>\n<td>Managed containers on Azure<\/td>\n<td>Good developer experience; KEDA scaling<\/td>\n<td>Azure-specific operational model<\/td>\n<td>Choose if workloads are primarily Azure-based<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Run<\/strong><\/td>\n<td>Serverless containers<\/td>\n<td>Very simple deploy; scale-to-zero patterns<\/td>\n<td>Platform constraints; Google-specific<\/td>\n<td>Choose for HTTP workloads with bursty traffic<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed Kubernetes<\/strong><\/td>\n<td>Full control across environments<\/td>\n<td>Portability; no managed-service constraints<\/td>\n<td>Highest ops cost; steep learning curve<\/td>\n<td>Choose when you must control everything and accept ops overhead<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Internal API modernization with controlled network access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A finance enterprise is decomposing a monolith into internal microservices. Services must be reachable only within corporate networks, with strict auditability.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Container images stored in <strong>OCIR<\/strong><\/li>\n<li>Services deployed to <strong>OCI Container Instances<\/strong> (or OKE if Kubernetes standards are mandated)<\/li>\n<li>Workloads run in <strong>private subnets<\/strong><\/li>\n<li>Ingress via <strong>OCI Load Balancer<\/strong> (internal) and corporate connectivity (VPN\/FastConnect)<\/li>\n<li>Secrets in <strong>OCI Vault<\/strong><\/li>\n<li>Logs in <strong>OCI Logging<\/strong>, alarms in <strong>OCI Monitoring<\/strong>, audit via <strong>OCI Audit<\/strong><\/li>\n<li><strong>Why this service was chosen:<\/strong> The \u201cApplication Container\u201d approach standardizes deployment via images while avoiding host management; private networking aligns with security controls.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Faster release cadence with consistent deployments<\/li>\n<li>Reduced attack surface (no public IPs)<\/li>\n<li>Better operational visibility and audit trails<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: Public SaaS API with minimal platform overhead<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup needs to ship a public API quickly with a small team and limited SRE bandwidth.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Build\/push images to <strong>OCIR<\/strong><\/li>\n<li>Run API on <strong>OCI Container Instances<\/strong><\/li>\n<li>Public ingress via a single <strong>OCI Load Balancer<\/strong> (TLS termination)<\/li>\n<li>Use managed database (Autonomous Database or MySQL\u2014choice depends on app needs)<\/li>\n<li>Basic alarms for uptime and error rates<\/li>\n<li><strong>Why this service was chosen:<\/strong> Containers provide portability and developer speed; managed runtime avoids building Kubernetes expertise early.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Quick deployments, simpler operations<\/li>\n<li>Cost control via right-sizing and image optimization<\/li>\n<li>Clear migration path to OKE if complexity grows<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is \u201cApplication Container\u201d an active OCI service today?<\/strong><br\/>\n\u201cApplication Container\u201d is often used to refer to <strong>Oracle Application Container Cloud Service (Classic)<\/strong>, which may be legacy\/retired for new onboarding. For OCI, similar functionality is typically delivered by <strong>OCI Container Instances<\/strong> or <strong>OKE<\/strong>. <strong>Verify in official Oracle docs for your tenancy.<\/strong><\/p>\n\n\n\n<p>2) <strong>What is the closest OCI-native equivalent to Application Container?<\/strong><br\/>\nUsually <strong>OCI Container Instances<\/strong> for \u201crun my container\u201d simplicity, or <strong>OKE<\/strong> if you need Kubernetes.<\/p>\n\n\n\n<p>3) <strong>Do I need Kubernetes to run containers on Oracle Cloud?<\/strong><br\/>\nNo. You can run containers using managed runtimes (if available) or on Compute instances with Docker. Kubernetes is optional.<\/p>\n\n\n\n<p>4) <strong>Where should I store container images in Oracle Cloud?<\/strong><br\/>\nUse <strong>OCI Registry (OCIR)<\/strong> for private images and IAM-governed access.<\/p>\n\n\n\n<p>5) <strong>How do I secure my container endpoint?<\/strong><br\/>\nPrefer private subnets; place an OCI Load Balancer in front; restrict ingress; use TLS; optionally use WAF\/API Gateway (verify) and strong IAM.<\/p>\n\n\n\n<p>6) <strong>How do I manage secrets for container apps on OCI?<\/strong><br\/>\nUse <strong>OCI Vault<\/strong>. Avoid embedding secrets in images. The injection mechanism depends on your runtime\u2014verify.<\/p>\n\n\n\n<p>7) <strong>What networking is required?<\/strong><br\/>\nAt minimum: a VCN, a subnet, and security rules allowing required ports. Production usually uses private subnets + LB + controlled egress.<\/p>\n\n\n\n<p>8) <strong>What\u2019s the biggest cause of deployment failure?<\/strong><br\/>\nMisconfigured IAM permissions for pulling images from OCIR and misconfigured security lists\/NSGs for inbound traffic.<\/p>\n\n\n\n<p>9) <strong>How do I monitor container health?<\/strong><br\/>\nUse OCI Monitoring metrics (service-provided) plus application metrics. Add alarms for availability and resource saturation.<\/p>\n\n\n\n<p>10) <strong>Is there an Always Free option for this pattern?<\/strong><br\/>\nOCI Free Tier exists, but eligibility varies by service and region. Verify current free-tier coverage for Container Instances, LB, and Logging.<\/p>\n\n\n\n<p>11) <strong>Can I run stateful workloads (databases) in Application Container?<\/strong><br\/>\nNot recommended. Use managed database services. Containers are best for stateless services.<\/p>\n\n\n\n<p>12) <strong>How do I roll back a bad release?<\/strong><br\/>\nUse immutable tags\/versions; redeploy the prior image tag; keep a rollback runbook. Advanced traffic shifting typically requires LB-based patterns.<\/p>\n\n\n\n<p>13) <strong>Do I need a load balancer for production?<\/strong><br\/>\nFor most production HTTP services, yes\u2014especially for TLS termination, stable ingress, and multi-instance distribution.<\/p>\n\n\n\n<p>14) <strong>How do I reduce container image size?<\/strong><br\/>\nUse slim base images, multi-stage builds, remove build tools, and pin dependencies.<\/p>\n\n\n\n<p>15) <strong>What\u2019s the migration path from legacy Classic Application Container?<\/strong><br\/>\nTypically: rebuild images \u2192 push to OCIR \u2192 deploy to OCI Container Instances or OKE \u2192 rework IAM\/networking\/observability to OCI constructs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Application Container<\/h2>\n\n\n\n<p>The most reliable resources are OCI-native container runtime and registry docs, plus any legacy Classic docs your account still exposes.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Documentation<\/td>\n<td>Entry point for all OCI services, including IAM, networking, logging, and container services: https:\/\/docs.oracle.com\/en-us\/iaas\/<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Container Engine for Kubernetes (OKE) docs<\/td>\n<td>Managed Kubernetes reference and tutorials: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/ContEng\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Registry (OCIR) docs<\/td>\n<td>How to authenticate, push\/pull images, and manage repos: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Registry\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI IAM docs<\/td>\n<td>Policies, compartments, groups, dynamic groups: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Networking (VCN) docs<\/td>\n<td>Subnets, security lists\/NSGs, gateways, routing: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/overview.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Logging docs<\/td>\n<td>Central logging and search: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Logging\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Monitoring docs<\/td>\n<td>Metrics, alarms, notifications: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Monitoring\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Vault \/ Key Management docs<\/td>\n<td>Secrets, keys, certs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official pricing page<\/td>\n<td>Oracle Cloud Pricing<\/td>\n<td>Official pricing entry point: https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Official cost tool<\/td>\n<td>Oracle Cloud Cost Estimator<\/td>\n<td>Build region-specific estimates without guessing: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<\/tr>\n<tr>\n<td>Architecture center<\/td>\n<td>Oracle Architecture Center<\/td>\n<td>Reference architectures and best practices: https:\/\/www.oracle.com\/cloud\/architecture\/<\/td>\n<\/tr>\n<tr>\n<td>Official tutorials\/labs<\/td>\n<td>Oracle Cloud Free Tier \/ Getting Started<\/td>\n<td>Account setup and foundational labs: https:\/\/www.oracle.com\/cloud\/free\/<\/td>\n<\/tr>\n<tr>\n<td>Official CLI docs<\/td>\n<td>OCI CLI installation<\/td>\n<td>Automation and scripting reference: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/td>\n<\/tr>\n<tr>\n<td>Community learning<\/td>\n<td>Oracle Cloud Infrastructure blogs (official)<\/td>\n<td>Practical patterns and updates (validate accuracy): https:\/\/blogs.oracle.com\/cloud-infrastructure\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<blockquote>\n<p>If you specifically need <strong>Oracle Application Container Cloud Service (Classic)<\/strong> documentation and your account still provides it, use the documentation links available from within your Classic console. Availability and URLs can differ; <strong>verify in your account\u2019s official documentation hub<\/strong>.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following institutes are provided as training options. Verify course outlines, instructors, and accreditation details on their websites.<\/p>\n\n\n\n<p>1) <strong>DevOpsSchool.com<\/strong>\n&#8211; <strong>Suitable audience:<\/strong> DevOps engineers, SREs, platform engineers, developers\n&#8211; <strong>Likely learning focus:<\/strong> DevOps practices, CI\/CD, containers, Kubernetes, cloud fundamentals (including Oracle Cloud topics depending on catalog)\n&#8211; <strong>Mode:<\/strong> Online\/corporate\/self-paced\/live (check website)\n&#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n\n\n\n<p>2) <strong>ScmGalaxy.com<\/strong>\n&#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate DevOps practitioners\n&#8211; <strong>Likely learning focus:<\/strong> SCM, DevOps tooling, CI\/CD pipelines, automation fundamentals\n&#8211; <strong>Mode:<\/strong> Online\/corporate\/self-paced\/live (check website)\n&#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n\n\n\n<p>3) <strong>CLoudOpsNow.in<\/strong>\n&#8211; <strong>Suitable audience:<\/strong> Cloud operations and DevOps engineers\n&#8211; <strong>Likely learning focus:<\/strong> Cloud operations, monitoring, automation, SRE-aligned practices\n&#8211; <strong>Mode:<\/strong> Check website\n&#8211; <strong>Website:<\/strong> https:\/\/cloudopsnow.in\/<\/p>\n\n\n\n<p>4) <strong>SreSchool.com<\/strong>\n&#8211; <strong>Suitable audience:<\/strong> SREs, operations teams, reliability-focused engineers\n&#8211; <strong>Likely learning focus:<\/strong> SRE practices, observability, incident management, SLIs\/SLOs, reliability engineering\n&#8211; <strong>Mode:<\/strong> Check website\n&#8211; <strong>Website:<\/strong> https:\/\/sreschool.com\/<\/p>\n\n\n\n<p>5) <strong>AiOpsSchool.com<\/strong>\n&#8211; <strong>Suitable audience:<\/strong> Ops teams adopting AIOps and automation\n&#8211; <strong>Likely learning focus:<\/strong> AIOps concepts, monitoring analytics, automation, incident reduction\n&#8211; <strong>Mode:<\/strong> Check website\n&#8211; <strong>Website:<\/strong> https:\/\/aiopsschool.com\/<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>The following sites are provided as trainer\/platform directories. Verify trainer profiles and Oracle Cloud coverage on each site.<\/p>\n\n\n\n<p>1) <strong>RajeshKumar.xyz<\/strong>\n&#8211; <strong>Likely specialization:<\/strong> DevOps\/cloud coaching (verify specific Oracle Cloud topics on site)\n&#8211; <strong>Suitable audience:<\/strong> Individuals and teams seeking guided training\n&#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n\n\n\n<p>2) <strong>devopstrainer.in<\/strong>\n&#8211; <strong>Likely specialization:<\/strong> DevOps tooling, CI\/CD, containers, cloud fundamentals\n&#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate engineers\n&#8211; <strong>Website:<\/strong> https:\/\/devopstrainer.in\/<\/p>\n\n\n\n<p>3) <strong>devopsfreelancer.com<\/strong>\n&#8211; <strong>Likely specialization:<\/strong> Freelance DevOps consulting\/training engagements (verify offerings)\n&#8211; <strong>Suitable audience:<\/strong> Teams needing short-term expertise\n&#8211; <strong>Website:<\/strong> https:\/\/devopsfreelancer.com\/<\/p>\n\n\n\n<p>4) <strong>devopssupport.in<\/strong>\n&#8211; <strong>Likely specialization:<\/strong> DevOps support and enablement (verify training vs support offerings)\n&#8211; <strong>Suitable audience:<\/strong> Ops\/DevOps teams needing hands-on guidance\n&#8211; <strong>Website:<\/strong> https:\/\/devopssupport.in\/<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>The following companies are listed as consulting providers. Verify service scope, references, and statements of work directly with the vendor.<\/p>\n\n\n\n<p>1) <strong>cotocus.com<\/strong>\n&#8211; <strong>Likely service area:<\/strong> Cloud\/DevOps consulting (verify Oracle Cloud specialism on site)\n&#8211; <strong>Where they may help:<\/strong> Architecture, migration planning, CI\/CD implementation, operations setup\n&#8211; <strong>Consulting use case examples:<\/strong>\n  &#8211; Container platform selection (Container Instances vs OKE)\n  &#8211; OCIR and IAM policy design\n  &#8211; VCN and ingress\/egress hardening\n&#8211; <strong>Website:<\/strong> https:\/\/cotocus.com\/<\/p>\n\n\n\n<p>2) <strong>DevOpsSchool.com<\/strong>\n&#8211; <strong>Likely service area:<\/strong> DevOps consulting and training services\n&#8211; <strong>Where they may help:<\/strong> CI\/CD pipelines, containerization standards, operational readiness\n&#8211; <strong>Consulting use case examples:<\/strong>\n  &#8211; Container build and deployment pipelines to OCIR\n  &#8211; Observability setup (Logging\/Monitoring alarms)\n  &#8211; Governance\/tagging for cost control\n&#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n\n\n\n<p>3) <strong>DEVOPSCONSULTING.IN<\/strong>\n&#8211; <strong>Likely service area:<\/strong> DevOps consulting services (verify Oracle Cloud coverage on site)\n&#8211; <strong>Where they may help:<\/strong> Toolchain integration, automation, SRE practices adoption\n&#8211; <strong>Consulting use case examples:<\/strong>\n  &#8211; Secure runtime deployment patterns in OCI\n  &#8211; Environment standardization (dev\/stage\/prod)\n  &#8211; Incident response and runbook development\n&#8211; <strong>Website:<\/strong> https:\/\/devopsconsulting.in\/<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before this service<\/h3>\n\n\n\n<p>To succeed with an Application Container approach on Oracle Cloud, learn:\n&#8211; Linux and basic networking (DNS, routing, ports, TLS)\n&#8211; Containers:\n  &#8211; Dockerfiles, image tagging, registries\n  &#8211; container security basics (non-root, minimal images)\n&#8211; OCI fundamentals:\n  &#8211; compartments, IAM policies\n  &#8211; VCN, subnets, security lists\/NSGs\n  &#8211; OCIR basics<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Advanced OCI networking (private endpoints, NAT, service gateways\u2014verify)<\/li>\n<li>Observability:<\/li>\n<li>structured logging<\/li>\n<li>metrics, tracing (OpenTelemetry patterns)<\/li>\n<li>Release engineering:<\/li>\n<li>blue\/green and canary patterns<\/li>\n<li>GitOps concepts<\/li>\n<li>Kubernetes (OKE) if your platform needs grow:<\/li>\n<li>Helm\/Kustomize<\/li>\n<li>Ingress controllers<\/li>\n<li>service mesh (only if justified)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Engineer (OCI)<\/li>\n<li>DevOps Engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Platform Engineer<\/li>\n<li>Solutions Architect<\/li>\n<li>Backend Developer (cloud-native)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle certification offerings change over time. Start here and verify current paths:\n&#8211; Oracle University: https:\/\/education.oracle.com\/<br\/>\n&#8211; OCI certifications listing (verify current): search Oracle University for \u201cOCI certification\u201d.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Deploy a REST API container with OCIR + runtime + alarms.<\/li>\n<li>Add a database and implement migrations safely.<\/li>\n<li>Add private networking and expose via Load Balancer only.<\/li>\n<li>Implement CI\/CD: build \u2192 scan \u2192 push \u2192 deploy.<\/li>\n<li>Add structured logs and a dashboard for latency\/error rate.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure):<\/strong> Oracle\u2019s current-generation cloud platform with IAM, VCN, compute, and managed services.<\/li>\n<li><strong>Oracle Cloud Classic:<\/strong> Earlier generation Oracle Cloud platform (legacy for many services).<\/li>\n<li><strong>Container image:<\/strong> Immutable package containing app code and dependencies.<\/li>\n<li><strong>OCIR (OCI Registry):<\/strong> Oracle\u2019s container registry service for storing container images.<\/li>\n<li><strong>Container runtime:<\/strong> The service that runs container images (e.g., Container Instances or Kubernetes nodes).<\/li>\n<li><strong>VCN (Virtual Cloud Network):<\/strong> A private network in OCI.<\/li>\n<li><strong>Subnet:<\/strong> A segmented IP range within a VCN where resources attach.<\/li>\n<li><strong>Security List \/ NSG:<\/strong> OCI network access control constructs controlling allowed ingress\/egress.<\/li>\n<li><strong>Ingress:<\/strong> Incoming traffic to your service.<\/li>\n<li><strong>Egress:<\/strong> Outgoing traffic from your service.<\/li>\n<li><strong>IAM policy:<\/strong> Rules controlling access to OCI resources.<\/li>\n<li><strong>Compartment:<\/strong> OCI\u2019s logical container for organizing and isolating resources and permissions.<\/li>\n<li><strong>Auth Token:<\/strong> Credential used for certain authentications (commonly Docker login to OCIR).<\/li>\n<li><strong>TLS termination:<\/strong> Decrypting HTTPS at an edge component (like a load balancer).<\/li>\n<li><strong>Observability:<\/strong> The combination of logs, metrics, and traces used to understand system behavior.<\/li>\n<li><strong>SLO\/SLI:<\/strong> Reliability targets (SLO) and measurements (SLI) used by SRE practices.<\/li>\n<li><strong>Immutable deployment:<\/strong> Deployment method where a new version is deployed as a new artifact, rather than modifying running systems in place.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p><strong>Application Container<\/strong> in <strong>Oracle Cloud<\/strong> most commonly maps to the legacy <strong>Oracle Application Container Cloud Service (Classic)<\/strong>, which many teams now replace with OCI-native services. In modern OCI, the practical \u201cApplication Container\u201d outcome is typically achieved using <strong>OCI Container Instances<\/strong> (or <strong>OKE<\/strong> for Kubernetes), backed by <strong>OCIR<\/strong> for images and governed by <strong>IAM<\/strong>, <strong>VCN<\/strong>, and <strong>Logging\/Monitoring<\/strong>.<\/p>\n\n\n\n<p>Why it matters:\n&#8211; It standardizes application delivery around container images.\n&#8211; It reduces server-management overhead compared to DIY Docker on VMs.\n&#8211; It provides a clear path to production-ready patterns with private networking, controlled ingress, and centralized observability.<\/p>\n\n\n\n<p>Key cost\/security points:\n&#8211; Costs are driven by runtime CPU\/memory, load balancers, outbound bandwidth, and log volume\u2014use the <strong>OCI Cost Estimator<\/strong> rather than guessing.\n&#8211; Security depends on least-privilege IAM, private subnets, TLS, and correct secret handling with <strong>OCI Vault<\/strong>.<\/p>\n\n\n\n<p>When to use it:\n&#8211; Use an Application Container approach when you want managed container execution with strong governance and minimal ops burden.\n&#8211; Prefer OCI-native services for new builds; treat Classic-era Application Container as legacy unless your account explicitly supports it.<\/p>\n\n\n\n<p><strong>Next learning step:<\/strong> Deepen OCI fundamentals (IAM + VCN) and then choose your runtime path\u2014<strong>Container Instances<\/strong> for simplicity or <strong>OKE<\/strong> for Kubernetes-based platforms\u2014using Oracle\u2019s official OCI docs: https:\/\/docs.oracle.com\/en-us\/iaas\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Other Services<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62,63],"tags":[],"class_list":["post-748","post","type-post","status-publish","format-standard","hentry","category-oracle-cloud","category-other-services"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=748"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/748\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}