Provisioning Fedora CoreOS on Oracle Cloud Infrastructure (OCI)

This guide shows how to provision new Fedora CoreOS (FCOS) nodes on Oracle Cloud Infrastructure. Fedora CoreOS images are currently not published directly on Oracle Cloud Infrastructure. Thus you must first download the Fedora CoreOS image for Oracle Cloud Infrastructure, then upload it to your account as a custom image.

Prerequisites

Before provisioning an FCOS machine, you must have an Ignition configuration file containing your customizations. If you do not have one, see Producing an Ignition File.

Fedora CoreOS has a default core user that can be used to explore the OS. If you want to use it, finalize its configuration by providing e.g. an SSH key.

If you do not want to use Ignition to get started, you can make use of the Afterburn support.

You also need to have access to an Oracle Cloud Infrastructure account. The examples below use the oci command-line tool and jq as a command-line JSON processor.

This guide currently only covers Virtual Machine shapes and not Bare Metal ones. See issue #414 for details.

Downloading an Oracle Cloud Infrastructure image

Fedora CoreOS is designed to be updated automatically, with different schedules per stream. Once you have picked the relevant stream, download, verify and decompress the latest Oracle Cloud Infrastructure image:

ARCH="x86_64"    # or "aarch64"
STREAM="stable"  # or "testing", "next"
coreos-installer download -s $STREAM -a $ARCH -p oraclecloud -f qcow2.xz --decompress

Both x86_64 and aarch64 architectures are supported on Oracle Cloud Infrastructure.

Alternatively, you can manually download an Oracle Cloud Infrastructure image from the download page.

Uploading the image to Oracle Cloud Infrastructure

Identify the ID of your root compartment.

Listing the compartments in your tenancy.

oci iam compartment list
ROOT_COMPARTMENT_ID=<root_compartment_id>

The root compartment OCID is the same as your tenancy OCID. You can find this information in your CLI configuration at ~/.oci/config or in the Cloud Console.

If you only have one tenant/root compartment you can use the following command to get that information more easily.

Set root compartment id based on the first compartment in list.

ROOT_COMPARTMENT_ID=$(oci iam compartment list |
                      jq --raw-output '.data[0]."compartment-id"')

Create a new compartment for testing.

COMPARTMENT_ID=$(oci iam compartment create                \
                 --name fedora-coreos-test                 \
                 --compartment-id $ROOT_COMPARTMENT_ID     \
                 --description "Fedora CoreOS compartment" \
                 | jq -r '.data.id')

Create a storage bucket for the image upload.

BUCKET_NAME="fedora-coreos"
oci os bucket create --compartment-id $COMPARTMENT_ID --name $BUCKET_NAME

Upload the image to the storage bucket.

FCOS_VERSION='...'
IMAGE_NAME="fedora-coreos-${FCOS_VERSION}-oraclecloud.${ARCH}.qcow2"
FILE_PATH="./${IMAGE_NAME}"
oci os object put --bucket-name $BUCKET_NAME --file $FILE_PATH

View the object in the bucket.

oci os object list -bn $BUCKET_NAME

Import the image as a custom image and remember its ID.

NAMESPACE=$(oci os ns get | jq -r '.data')
IMAGE_ID=$(oci compute image import from-object               \
           --compartment-id $COMPARTMENT_ID                   \
           --namespace $NAMESPACE                             \
           --bucket-name $BUCKET_NAME                         \
           --name $IMAGE_NAME                                 \
           --display-name "Fedora CoreOS $FCOS_VERSION $ARCH" \
           --launch-mode PARAVIRTUALIZED                      \
           --source-image-type QCOW2                          \
           --operating-system "Linux"                         \
           | jq -r '.data.id')

Wait until the import is completed.

Loop until the image becomes available.

while true; do
    state=$(oci compute image get --image-id $IMAGE_ID |
            jq -r '.data."lifecycle-state"')
    echo "$(date): $state"
    [ "$state" == "AVAILABLE" ] && break || sleep 30
done

The image needs to be configured so the platform knows what it is capable of. Here we’ll pull the default version 1.2 capability set and configure some additional ones. Note that some of these are architecture specific, but don’t hurt because they also have to be opted in at runtime anyway.

Configure additional image capabilities.

GLOBAL_CAP_ID=$(
    oci compute global-image-capability-schema list --all | jq -r '.data[0].id')
GLOBAL_CAP_VERSION_NAME=$(
    oci compute global-image-capability-schema-version list --all \
    --global-image-capability-schema-id $GLOBAL_CAP_ID            \
    --display-name 1.2 | jq -r '.data[0].name')

oci compute image-capability-schema create \
    --global-image-capability-schema-version-name $GLOBAL_CAP_VERSION_NAME \
    --compartment-id $COMPARTMENT_ID --image-id $IMAGE_ID --schema-data '{
    "Compute.AMD_SecureEncryptedVirtualization": {
        "default-value": true,
        "descriptor-type": "boolean",
        "source": "IMAGE"
    },
    "Compute.SecureBoot": {
        "default-value": true,
        "descriptor-type": "boolean",
        "source": "IMAGE"
    },
    "Storage.Iscsi.MultipathDeviceSupported": {
        "default-value": true,
        "descriptor-type": "boolean",
        "source": "IMAGE"
    }
}'

Now we can mark the image as compatible with appropriate VM shapes.

Remove default compatible shapes.

oci compute image-shape-compatibility-entry \
    list --image-id $IMAGE_ID | jq -r '.data[].shape' |
while read shape; do
    [[ "$shape" =~ Generic ]] && continue # Can't remove Generic shapes
    echo "Removing $shape from $IMAGE_ID"
    oci compute image-shape-compatibility-entry remove \
        --force --image-id $IMAGE_ID --shape-name "${shape}"
done

Mark as compatible with appropriate VM shapes.

shapes_info=$(oci compute shape list --compartment-id $COMPARTMENT_ID | jq -r '.data[]')

# Limit to VM shapes only
# https://github.com/coreos/fedora-coreos-tracker/issues/414#issuecomment-1795808614
vm_shapes_info=$(jq -r 'select(.shape | select(startswith("VM")))' <<< "$shapes_info")

# Determine x86_64 and aarch64 shapes
amd64_shape_ids=$(jq -r 'select(."processor-description"  |
                                contains("AMD", "Intel")) |
                                .shape' <<< "$vm_shapes_info")
arm64_shape_ids=$(jq -r 'select(."processor-description" |
                                contains("Ampere"))      |
                                .shape' <<< "$vm_shapes_info")

# Apply the appropriate shapes to the IMAGE
[ "$ARCH" == "x86_64" ] && shape_ids="$amd64_shape_ids"
[ "$ARCH" == "aarch64" ] && shape_ids="$arm64_shape_ids"
for shape in $shape_ids; do
    oci compute image-shape-compatibility-entry add \
        --image-id $IMAGE_ID --shape-name "${shape}"
done

List all the compatible shapes for an image.

oci compute image-shape-compatibility-entry list --image-id $IMAGE_ID | jq -r '.data[].shape'

Launching an instance

Create a Virtual Cloud Network.

NETWORK_ID=$(oci network vcn create        \
    --compartment-id $COMPARTMENT_ID       \
    --display-name "fedora-coreos-network" \
    --cidr-blocks '["10.0.0.0/16"]'        \
    --dns-label "myfcos"                   \
    --wait-for-state AVAILABLE | jq -r '.data.id')

Create a Subnet.

SUBNET_ID=$(oci network subnet create     \
    --compartment-id $COMPARTMENT_ID      \
    --display-name "fedora-coreos-subnet" \
    --cidr-block "10.0.0.0/24"            \
    --vcn-id $NETWORK_ID                  \
    --dns-label "subnet1"                 \
    --wait-for-state AVAILABLE | jq -r '.data.id')

Create an Internet Gateway.

GATEWAY_ID=$(oci network internet-gateway create \
    --compartment-id $COMPARTMENT_ID             \
    --display-name "fedora-coreos-gateway"       \
    --vcn-id $NETWORK_ID                         \
    --is-enabled true | jq -r '.data.id')

Add a Rule to the Route Table.

ROUTE_TABLE_ID=$(oci network route-table list \
    --compartment-id $COMPARTMENT_ID          \
    --vcn-id $NETWORK_ID | jq -r '.data[0].id')

oci network route-table update \
    --rt-id $ROUTE_TABLE_ID    \
    --force --route-rules      \
    '[{"cidrBlock":"0.0.0.0/0","networkEntityId":"'"${GATEWAY_ID}"'"}]'

You can now choose an availability domain or just set it to be the first one in the region.

Pick an availability domain.

AVAILABILITY_DOMAIN=$(oci iam availability-domain list | jq -r '.data[0].name')

View all possible domains with oci iam availability-domain list.

Now we can launch an instance. If you just want SSH access you can skip providing an Ignition configuration to the instance.

Launching an instance without an Ignition configuration.

NAME=fedora-coreos
SHAPE=VM.Standard.E5.Flex # or VM.Standard.A1.Flex for aarch64
SSHKEYS="/path/to/authorized_keys" # path to authorized_keys file

INSTANCE_ID=$(oci compute instance launch               \
    --compartment-id $COMPARTMENT_ID                    \
    --availability-domain $AVAILABILITY_DOMAIN          \
    --display-name $NAME                                \
    --image-id $IMAGE_ID                                \
    --shape $SHAPE                                      \
    --shape-config '{"ocpus": '2', "memoryInGBs": '4'}' \
    --subnet-id $SUBNET_ID                              \
    --assign-public-ip true                             \
    --ssh-authorized-keys-file $SSHKEYS                 \
    --wait-for-state TERMINATED                         \
    --wait-for-state RUNNING | jq -r '.data.id')

The free tier eligible VM.Standard.E2.1.Micro shape has less than the recommended amount of memory for Fedora CoreOS to run. For a free tier eligible instance it is recommended to use the ARM based VM.Standard.A1.Flex shape.

Launching an instance with customizations and an Ignition configuration.

NAME=fedora-coreos
SHAPE=VM.Standard.E5.Flex      # or VM.Standard.A1.Flex for aarch64
DISK=50                        # size of boot volume in GBs
OCPUS=2                        # number of allocated OCPUs
MEMORY=4                       # size of memory in GBs
INSTANCE_HOSTNAME=mycoreos     # hostname for the instance
USERDATA="/path/to/config.ign" # path to your Ignition config
                               # that sets a ssh key

INSTANCE_ID=$(oci compute instance launch               \
    --compartment-id $COMPARTMENT_ID                    \
    --availability-domain $AVAILABILITY_DOMAIN          \
    --display-name $NAME                                \
    --image-id $IMAGE_ID                                \
    --shape $SHAPE                                      \
    --shape-config                                      \
    '{"ocpus": '${OCPUS}', "memoryInGBs": '${MEMORY}'}' \
    --subnet-id $SUBNET_ID                              \
    --assign-public-ip true                             \
    --hostname-label $INSTANCE_HOSTNAME                 \
    --boot-volume-size-in-gbs $DISK                     \
    --user-data-file $USERDATA                          \
    --wait-for-state TERMINATED                         \
    --wait-for-state RUNNING | jq -r '.data.id')

While the Oracle Cloud Infrastructure documentation mentions cloud-init, Fedora CoreOS does not support cloud-init. It accepts only Ignition configuration files. When using the Cloud Console, an Ignition configuration can be placed into "Cloud-init script" field.

To enable SecureBoot you can pass additional config via --platform-config '{"type": "AMD_VM", "isSecureBootEnabled": true}' or --platform-config '{"type": "INTEL_VM", "isSecureBootEnabled": true}' or depending on the processor type of your instance. Enabling Secureboot isn’t currently possible for ARM instances.

Get the public IP address of the instance.

PUBLIC_IP=$(oci compute instance list-vnics --instance-id $INSTANCE_ID |
            jq -r '.data[0]."public-ip"')
echo "The instance public IPV4 is: $PUBLIC_IP"

You now should be able to SSH into the instance using the associated IP address.

SSH into the running instance.

ssh "core@${PUBLIC_IP}"

Want to help? Learn how to contribute to Fedora Docs ›