Repository navigation
16 File Storage ‐ basic
.
.
.
.
.
OCI File Storage is a fully managed, elastic, shared file system compatible with NFS v3.0. It is designed to store files that need to be accessed simultaneously by multiple instances.
You can connect to OCI File Storage from: Bare metal instances, Virtual machine instances, Container instances and Resources inside your Virtual Cloud Network (VCN)
You can also access the file system from outside the VCN using: VCN peering, OCI FastConnect and IPsec VPN connection
OCI File Storage includes several protection features: Snapshots for data protection of your file system, Encryption at rest by default for all stored data and snapshot data using AES-256, By default, file systems use Oracle-managed encryption keys, Customers can optionally use customer-managed keys through OCI Vault, In-transit encryption can be configured using TLS to secure data between instances and mounted file systems.
Key features:
- Supports Network File System version 3.0 (NFS v3.0).
- Data is replicated for durability within each availability domain.
- Scales automatically to accommodate growth up to 8 exabytes.
- Provisioning is fully managed and automatic.
- Scales from a single byte to exabytes without upfront provisioning.
- Well-suited for applications that require a shared file system.
- Provides a durable, scalable, secure, enterprise-grade network file system.
- Supports the Network Lock Manager (NLM) protocol for file locking.
You can connect to OCI File Storage from:
- Bare metal instances
- Virtual machine instances
- Container instances
- Resources inside your Virtual Cloud Network (VCN)
You can also access the file system from outside the VCN using:
- VCN peering
- OCI FastConnect
- IPsec VPN connection
OCI File Storage supports many workloads:
-
Lift and shift of enterprise applications
Migrate existing Oracle applications that need NFS storage, such as Oracle E-Business Suite. -
Structured and unstructured data growth
Provides access to an unlimited pool of file systems to manage growing data. -
Analytic workloads
Use shared file systems to store persistent data. -
Scale-out applications
-
Test and development workloads
-
Stateful persistent storage for containers
Easily scale as your container-based environment grows. -
High-performance shared storage
Large compute clusters of thousands of instances can use file storage for high-performance shared storage.
OCI File Storage includes several protection features:
- Snapshots for data protection of your file system.
- Encryption at rest by default for all stored data and snapshot data using AES-256.
- By default, file systems use Oracle-managed encryption keys.
- Customers can optionally use customer-managed keys through OCI Vault.
- In-transit encryption can be configured using TLS to secure data between instances and mounted file systems.
OCI File Storage uses three main constructs: the file system, the Mount Target, and exports.
File System: The file system is the actual storage location where files exist. It is exported or made available through Mount Targets.
Mount Target: A Mount Target is an NFS endpoint that; Lives in a subnet.; Is highly available.; Provides the IP address or DNS name used in the mount command; Allows NFS clients to connect to a file system.
File systems are exported through Mount Targets. You can reuse the same Mount Target for multiple file systems by specifying an export in the Mount Target for each file system.
Export and Export Set: Exports control how NFS clients access file systems when they connect to a Mount Target; Each Mount Target maintains an export set; An export set contains one or many exports; A file system must have at least one export in one Mount Target for instances to mount it; You can create as many exports in a Mount Target for different file systems as you wish; Each file system associated with the Mount Target has at least one export in the export set.
Export Path: The export path is specified when an export is created. It: Uniquely identifies the file system within the Mount Target; Lets you associate many file systems to a single Mount Target.
Export Options: Export options are a set of parameters within the export; They specify the level of access granted to NFS clients when they connect to a Mount Target; You can have up to 100 options per export.
| Term | Definition |
|---|---|
| File System | The storage where files exist. |
| Mount Target | An NFS endpoint that lives in a subnet and is highly available. It provides the IP address or DNS name used in the mount command. |
| Export | The NFS control layer that controls how NFS clients access file systems when they connect to a Mount Target. |
| Export Set | A collection of one or more exports maintained by a Mount Target. |
| Export Path | A path specified when an export is created. It uniquely identifies the file system within the Mount Target. |
| Export Options | Parameters within an export that specify the level of access granted to NFS clients. Up to 100 options are allowed per export. |
The file system is the actual storage location where files exist. It is exported or made available through Mount Targets.
A Mount Target is an NFS endpoint that:
- Lives in a subnet.
- Is highly available.
- Provides the IP address or DNS name used in the mount command.
- Allows NFS clients to connect to a file system.
File systems are exported through Mount Targets. You can reuse the same Mount Target for multiple file systems by specifying an export in the Mount Target for each file system.
Exports control how NFS clients access file systems when they connect to a Mount Target.
- Each Mount Target maintains an export set.
- An export set contains one or many exports.
- A file system must have at least one export in one Mount Target for instances to mount it.
- You can create as many exports in a Mount Target for different file systems as you wish.
- Each file system associated with the Mount Target has at least one export in the export set.
The export path is specified when an export is created. It:
- Uniquely identifies the file system within the Mount Target.
- Lets you associate many file systems to a single Mount Target.
Export options are a set of parameters within the export. They specify the level of access granted to NFS clients when they connect to a Mount Target. You can have up to 100 options per export.
NFS Export Options provide granular access control for OCI File Storage.
They let you specify access levels for IP addresses or CIDR blocks through exports in a Mount Target.
The four parameters are source, ports, access, and squash.
You can allow read-only or read-write access, restrict clients so they cannot see each other’s file systems, and remap user and group IDs using squash settings.
OCI applies the first matching export option and ignores the rest, so order matters.
To deny access completely, the client’s source IP or CIDR must not appear in any export associated with the file system.
| Term | Definition |
|---|---|
| NFS Export Options | Parameters within an export that specify the level of access granted to NFS clients when they connect to a Mount Target. |
| Source | The IP address or CIDR block of the connecting NFS client. |
| CIDR Block | A range of IP addresses, such as 10.0.0.0/24. |
| Mount Target | The NFS endpoint used by clients to connect to a file system. |
| Export | The NFS control layer that controls how clients access a file system. |
| Privileged Ports | Ports that only the root user can open. |
| Squash | A setting that remaps user IDs (UIDs) and group IDs (GIDs) to anonymous UID/GID. |
| Read-Only | Client can read but not modify files. |
| Read-Write | Client can read and modify files. |
NFS Export Options let you create more granular access control. You can:
- Specify access levels for IP addresses or CIDR blocks.
- Control which clients can connect through exports in a Mount Target.
- Restrict access so that one client’s file system is inaccessible and invisible to another client.
- Allow or deny access to specific file systems for specific clients.
NFS Export Options include four main parameters:
The source is the IP address or CIDR block of the connecting NFS client.
Example:
10.0.0.0/2410.0.0.8
Ports can be:
- Privileged — only the root user can open privileged ports.
- Any — any port can be used.
Access can be:
- Read-only
- Read-write
Squash determines whether source clients have their user ID (UID) and group ID (GID) remapped to an anonymous UID and GID.
| Squash Setting | Behavior |
|---|---|
| All | All users and groups are remapped. |
| Root | Only the root user UID and GID combination is remapped. |
| None | No users are remapped. |
- File System A
- File System B
-
Client X — deployed in subnet
10.0.0.0/24 -
Client Y — deployed in subnet
10.0.1.0/24
- Client X should have read-write access to File System A.
- Client X should be denied access to File System B.
- Client Y should have read access to File System B.
- Client Y should be denied access to File System A.
For File System A:
- Source:
10.0.0.0/24 - Access: Read-write
- Do not include Client Y’s CIDR in any export for File System A.
For File System B:
- Source: Client Y’s IP address
- Access: Read-only
- Do not include Client X’s CIDR in any export for File System B.
To completely deny a client access to a file system, make sure the client’s source IP address or CIDR block is not included in any export for any Mount Target associated with that file system.
When an NFS request is made by a client, the File Storage service applies the first set of options that matches the client source IP address. Once the first set is applied, the rest are ignored.
| Entry | Source | Access |
|---|---|---|
| 1 | 10.0.0.0/16 |
Read-only |
| 2 | 10.0.0.8 |
Read-write |
If a client connects from IP address 10.0.0.8:
- The request source IP is contained in the CIDR block specified in Entry 1.
- The service applies the first match.
- Entry 2 is ignored.
- Result: The client gets read-only access, not read-write.
OCI File Storage uses three kinds of paths:
- Export paths uniquely identify a file system within a Mount Target. Up to 100 file systems can be associated with a single Mount Target. Export paths cannot be edited after creation.
-
Mount point paths are local directories on a client instance where the remote file system is mounted, such as
/mnt/mountpointA. -
File system paths are paths to directories inside the file system. They contain the file system’s contents and provide access to snapshots under
.snapshot/<snapshot_name>.
Understanding these three path types helps you mount, access, and manage OCI File Storage correctly.
| Term | Definition |
|---|---|
| Export Path | A path that uniquely identifies the file system within the Mount Target. |
| Mount Point Path | A path within a client instance to a locally accessible directory where the remote file system is mounted. |
| File System Path | A path to directories within the file system that contain the contents of the file system. |
| Mount Target | The NFS endpoint used by clients to connect to a file system. |
| Export | The NFS control layer that controls how clients access a file system. |
| Snapshot | A point-in-time copy of a file system, accessible under the file system’s root directory. |
OCI File Storage uses three kinds of paths:
- Export paths
- Mount point paths
- File system paths
Each path serves a different purpose and exists in a different location.
An export path uniquely identifies the file system within the Mount Target.
Key points:
- You can associate up to 100 file systems behind a single Mount Target.
- The export path is unrelated to any path within the file system or the client instance.
- An instance uses the export path to mount or logically attach to the file system.
- Export paths cannot be edited after the export is created.
- In the slide example, the export path uniquely identifies a file system within the Mount Target.
Note: The transcript mentions a “CIFS export” in the slide example. In the context of OCI File Storage, this refers to the export path that identifies the file system within the Mount Target.
A mount point path is a path within a client instance to a locally accessible directory to which the remote file system is mounted.
Key points:
- It exists on the client instance, not in the file system.
- It is the local directory where the external file system is attached.
- In a mount command, the mount point path appears as the local directory.
Example from the transcript:
/mnt/mountpointAIn this example, /mnt/mountpointA is the path to the directory on the client instance where the external file system is mounted.
A file system path is a path to directories within the file system. These directories contain the contents of the file system.
Key points:
- After the file system is mounted, you can create any directory structure within it.
- File system paths are used to access files and directories inside the file system.
- Snapshots of the file system can be accessed using the file system path under the file system’s root directory at:
.snapshot/<snapshot_name>
Example:
- If you create a snapshot named April 22, you can access it under the file system path at:
.snapshot/April 22
This is known as a file system path.
| Path Type | Where It Exists | Purpose |
|---|---|---|
| Export Path | In the Mount Target | Uniquely identifies the file system within the Mount Target and is used to mount it. |
| Mount Point Path | On the client instance | Local directory where the remote file system is mounted. |
| File System Path | Inside the file system | Path to directories and contents within the file system, including snapshots. |