2.1 Compute Foundations: Bare Metal, Dedicated VM Hosts & Virtual Machines
Key Takeaways
- OCI's off-box virtualization architecture offloads network and storage virtualization to custom SmartNICs, delivering bare-metal I/O performance and eliminating hypervisor overhead.
- Bare Metal (BM) instances provide single-tenant dedicated physical hardware with direct access to processors, memory, and PCIe devices, ideal for high-performance databases and custom hypervisors (e.g., VMware ESXi).
- Dedicated Virtual Machine Hosts (DVH) deliver single-tenant hardware isolation for compliance requirements (PCI-DSS, HIPAA) while allowing customers to provision and manage multi-VM lifecycles on dedicated silicon.
- Virtual Machine (VM) instances run on multi-tenant shared hardware isolated by an Oracle-managed hypervisor, offering rapid elasticity, second-based provisioning, and low-cost multi-workload hosting.
- The choice between BM, DVH, and VM centers on tenancy isolation, provisioning agility, performance predictability, and administrative control over the virtualization stack.
2.1 Compute Foundations: Bare Metal, Dedicated VM Hosts & Virtual Machines
[!NOTE] Foundations Blueprint Focus: Compute is the foundational execution engine of Oracle Cloud Infrastructure (OCI). The OCI Foundations Associate (1Z0-1085-26) exam heavily tests your comprehension of compute virtualization models, the off-box virtualization architecture, and the operational trade-offs among Bare Metal instances, Dedicated Virtual Machine Hosts, and multi-tenant Virtual Machines.
Compute services in Oracle Cloud Infrastructure provide secure, resizable, and high-performance processing capacity in the cloud. Unlike legacy first-generation cloud platforms that run hypervisors directly on host processors to manage networking and storage emulation, OCI was engineered from the ground up as a Gen 2 enterprise cloud. At the core of this design is a clean architectural separation between host compute resources and cloud control plane virtualization.
The OCI Off-Box Virtualization Architecture
In traditional first-generation cloud architectures, the hypervisor running on the physical server performs multiple demanding tasks simultaneously: scheduling guest virtual machine vCPUs, managing guest memory, virtualizing local and remote block storage, and running complex software-defined networking (SDN) packet encapsulation. This traditional approach introduces several major architectural drawbacks:
- The "Hypervisor Tax" (Overhead): Between 10% and 15% of the physical server's CPU cycles and RAM are consumed purely by hypervisor management functions, leaving fewer raw resources for tenant workloads.
- The "Noisy Neighbor" Problem: When one tenant on a shared physical server initiates intensive network transfers or heavy disk I/O, the hypervisor's software networking stack experiences CPU contention, causing unpredictable latency spikes and throughput degradation for other tenants on the same box.
- Security Surface Exposure: Because the cloud management plane, network packet routing, and storage drivers reside in the same memory and hypervisor layer as customer workloads, any hypervisor breakout vulnerability could compromise host isolation.
+-------------------------------------------------------------------------+
| Traditional 1st-Gen Cloud Architecture |
| +-------------------------------------------------------------------+ |
| | Customer VM 1 | Customer VM 2 | SDN Engine | Storage Virtualizer | |
| +-------------------------------------------------------------------+ |
| | Monolithic In-Band Hypervisor (Consumes 10-15% Host CPU & Memory) | |
| +-------------------------------------------------------------------+ |
| | Physical Server Hardware (CPUs, RAM, Bus) | |
+--+-------------------------------------------------------------------+--+
+-------------------------------------------------------------------------+
| OCI Gen 2 Off-Box Virtualization |
| +-------------------------------------------------------------------+ |
| | Customer Workload / OS (Bare Metal or Thin Hypervisor VM Guests) | |
| +-------------------------------------------------------------------+ |
| | Physical Server Hardware: 100% CPU & Memory Dedicated to Tenant | |
+--+----------------------------------+--------------------------------+--+
| PCIe Bus Direct Attach
v
+-------------------------------------------------------------------------+
| Custom SmartNIC / Acceleration Card (Runs OCI SDN & Storage Planes) |
+-------------------------------------------------------------------------+
How Off-Box Virtualization Works
OCI completely re-engineered cloud virtualization by taking network and storage virtualization off the host server and placing it onto custom, dedicated hardware accelerator cards (commonly referred to as SmartNICs). These SmartNIC cards have their own dedicated processors, onboard memory, and hardened operating systems.
- Zero Overhead on Host CPU: The physical server's CPUs and memory are 100% dedicated to executing customer workloads. The host CPU never processes tenant-to-tenant network encapsulation or block storage encryption protocols.
- True Bare Metal Capability: Because network and storage virtualization exist entirely on the SmartNIC card, OCI can offer physical Bare Metal servers with zero Oracle software or hypervisors installed on the host. When a customer launches a Bare Metal instance, they get direct raw silicon access while still enjoying seamless integration with OCI Virtual Cloud Networks (VCNs) and remote Block Volumes.
- Elimination of Noisy Neighbors: Network bandwidth and storage IOPS are isolated and enforced directly by hardware controllers on the SmartNIC. One tenant's traffic burst cannot starve another tenant's CPU cores.
- Enhanced Security Isolation: The OCI control plane and customer compute environments are physically isolated. Customers cannot tamper with the cloud network fabric or inspect hypervisor control channels because those functions do not exist on the host hardware.
Bare Metal (BM) Instances
An OCI Bare Metal (BM) instance is a dedicated, single-tenant physical server provisioned directly to a single customer. There is no hypervisor installed by Oracle. The customer receives exclusive, uninhibited access to the physical motherboard, dual-socket x86 (AMD EPYC, Intel Xeon) or Arm (Ampere Altra) processors, massive system memory, and direct-attached NVMe solid-state storage.
Key Architectural Characteristics
- Single-Tenant Ownership: No other customer shares the physical chassis, CPU sockets, memory channels, or local storage.
- Direct Hardware Access: Customers can access low-level CPU performance counters, configure hardware-assisted virtualization flags, and interface directly with PCIe expansion buses.
- Zero Hypervisor Latency: Ideal for applications that require deterministic, microsecond-level response times without hypervisor CPU scheduling jitter.
- Custom Hypervisor Support: Customers can install their own virtualization stacks, including VMware ESXi (the foundation of Oracle Cloud VMware Solution - OCVS), OpenStack, Nutanix AHV, or hardened KVM hypervisors.
- Rapid Provisioning: Despite being physical dedicated servers, OCI automation provisions Bare Metal instances programmatically via Console, CLI, or Terraform in roughly 5 to 10 minutes.
Primary Bare Metal Use Cases
- Mission-Critical Enterprise Databases: Extremely demanding database workloads, such as Oracle Database Enterprise Edition, multi-terabyte Microsoft SQL Server, and large-scale SAP HANA deployments that require raw I/O throughput and hundreds of physical CPU cores.
- High-Performance Computing (HPC): Computational fluid dynamics, crash simulation modeling, seismic analysis, and weather forecasting that leverage high-frequency cores and sub-2-microsecond cluster networking (RDMA).
- Regulatory Isolation & Compliance: Workloads with strict compliance mandates prohibiting co-location on multi-tenant hardware.
- Specialized Legacy Workloads: Legacy applications requiring specific OS kernels, non-standard hypervisors, or software licenses tied to physical CPU sockets and cores.
Dedicated Virtual Machine Hosts (DVH)
A Dedicated Virtual Machine Host (DVH) is a physical server dedicated entirely to a single customer that is pre-configured with an Oracle-managed hypervisor. Instead of deploying a single monolithic Bare Metal operating system, the customer provisions their own collection of Virtual Machines on that dedicated hardware.
+-------------------------------------------------------------------------+
| Dedicated Virtual Machine Host (DVH) |
| +-------------------------------------------------------------------+ |
| | Customer VM 1 (Web) | Customer VM 2 (App) | Customer VM 3 (DB) | |
| +-------------------------------------------------------------------+ |
| | Oracle Managed Hypervisor (Restricted to a Single Customer) | |
| +-------------------------------------------------------------------+ |
| | Physical Server Dedicated to Customer A (No Multi-Tenant Sharing) | |
+--+-------------------------------------------------------------------+--+
Key Architectural Characteristics
- Hardware Isolation for Compliance: Provides the strict physical hardware isolation of Bare Metal while retaining the dynamic operational agility of Virtual Machines. Satisfies compliance standards such as PCI-DSS, HIPAA, and federal public sector frameworks that prohibit multi-tenant resource sharing.
- Customer-Managed VM Packing: The customer selects the physical host shape (e.g., AMD EPYC-based
DVH.Standard.E4.128) and independently provisions, resizes, stops, and restarts guest VMs within that host's total CPU and memory envelope. - Independent Lifecycle Management: The customer controls the placement of VMs. Restarting or deleting a guest VM does not release or reboot the underlying physical Dedicated Host.
- Licensing Efficiency (BYOL): Allows organizations to bring their existing enterprise licenses (e.g., Microsoft Windows Server, SQL Server, Oracle software) licensed per physical core or processor socket, maximizing software investment while running virtualized workloads.
Virtual Machine (VM) Instances
An OCI Virtual Machine (VM) instance runs as an independent, guest operating system environment on top of multi-tenant shared physical servers managed by Oracle's hypervisor. The hypervisor securely virtualizes the underlying CPU, memory, and hardware buses, while OCI SmartNICs handle networking and storage I/O off-box.
Key Architectural Characteristics
- Multi-Tenant Sharing: Multiple independent customer VMs share the physical CPU sockets and memory bus of a single enterprise-grade server, lowering the cost threshold for cloud computing.
- Sub-Minute Provisioning: Standard VM instances can be provisioned, booted, and operational in seconds (often under 45 seconds).
- Fine-Grained Sizing & Elasticity: Customers can launch small 1-OCPU VMs for dev/test and scale up to 64 OCPUs or more for production workloads.
- Cost Efficiency: Pay-as-you-go pricing billed per second (with a 1-minute minimum). Customers pay only for the exact compute capacity allocated to their virtual machine.
Primary Virtual Machine Use Cases
- Web and Application Tiers: Horizontally scalable e-commerce backends, REST APIs, and microservices.
- Development and Testing: Quick staging environments that can be spun up and torn down on demand.
- General-Purpose Enterprise Workloads: Internal business tools, ERP middleware, content management systems, and monitoring agents.
Architectural Comparison: Bare Metal vs. Dedicated Host vs. Standard VM
The following matrix contrasts the three core compute deployment models across critical architectural and operational dimensions:
| Architectural Dimension | Bare Metal (BM) Instance | Dedicated VM Host (DVH) | Standard Virtual Machine (VM) |
|---|---|---|---|
| Tenancy Model | Single-tenant (Dedicated hardware) | Single-tenant hardware hosting customer VMs | Multi-tenant (Shared physical hardware) |
| Hypervisor Layer | None (Customer controls OS directly) | Oracle-managed hypervisor on dedicated host | Oracle-managed hypervisor on shared host |
| Custom Hypervisors | Supported (VMware ESXi, KVM, Nutanix) | Not supported (Uses OCI hypervisor) | Not supported |
| Performance Profile | Maximum raw silicon speed, zero jitter | High VM performance, zero neighbor contention | High performance with SmartNIC offload |
| Provisioning Time | Minutes (~5-10 mins) | Host: ~10 mins; Guest VMs: Seconds | Seconds (~30-60 secs) |
| Cost Model | Billed for entire physical chassis | Billed for entire physical host chassis | Billed only for allocated VM OCPUs/RAM |
| Elastic Scaling | Coarse-grained (Chassis-level) | Fine-grained (VMs on dedicated host) | Ultra-dynamic (Autoscaling instance pools) |
| Primary Driver | Extreme I/O, custom virtualization, HPC | Strict regulatory compliance + VM agility | General compute, web apps, microservices |
What primary architectural advantage does OCI's off-box virtualization provide compared to traditional first-generation cloud virtualization?
An enterprise architecture team is migrating an existing on-premises VMware cluster to Oracle Cloud Infrastructure. They require direct access to the physical CPU virtualization extensions, non-standard hypervisor installation rights (VMware ESXi), and guaranteed maximum I/O performance. Which compute offering must they choose?
A financial institution must comply with strict PCI-DSS regulatory standards mandating complete physical hardware isolation from other cloud tenants. However, the engineering team requires the flexibility to spin up, resize, and destroy multiple development and testing virtual machines dynamically throughout the day. Which OCI compute service perfectly satisfies both requirements?