Provision the AMD Micro¶

The AMD VM.Standard.E2.1.Micro is your workhorse for tiny always-on things — static landing pages, health checks, small Node.js or Go services. You get two of these for free, so you can provision one now and one later, or provision both now.

Generate an SSH key pair (if you don't have one)¶

On your local machine:

ssh-keygen -t ed25519 -C "you@example.com" -f ~/.ssh/oci_lab

Set a passphrase (yes — even for a lab)
This creates ~/.ssh/oci_lab (private) and ~/.ssh/oci_lab.pub (public)

You'll paste the public key into the OCI console when provisioning.

Provision¶

Hamburger menu → Compute → Instances → Create instance.

Fill in:

Field	Value
Name	`web-1` (or whatever)
Compartment	root
Placement — Availability Domain	Any (pick the one with least load)
Image	Change image → Canonical Ubuntu → Ubuntu 24.04 Minimal
Shape	Change shape → Virtual machine → Ampere tab → Specialty and previous generation → check VM.Standard.E2.1.Micro (with the "Always Free-eligible" pill next to it)
Primary VNIC	Select your VCN (`lab-vcn`) and the public subnet
Assign a public IPv4 address	✓ Yes
Boot volume — Specify a custom boot volume size	47 GB (default is 47; leave it)
SSH keys	Paste public keys and paste the contents of `~/.ssh/oci_lab.pub`

Click Create. Provisioning takes about 60-90 seconds.

Verify¶

Once the instance status is Running, note the Public IP address (shown on the instance details page). Then from your local machine:

ssh -i ~/.ssh/oci_lab ubuntu@<public-ip>

The default username on Ubuntu images is ubuntu. Root SSH is disabled; ubuntu has passwordless sudo.

You should land at:

Welcome to Ubuntu 24.04 LTS (GNU/Linux 6.8.0-... aarch64)
...
ubuntu@web-1:~$

If SSH times out, see Troubleshooting: can't SSH.

First commands¶

Before doing anything meaningful:

# Update everything
sudo apt update && sudo apt upgrade -y

# Set the hostname (matches the OCI instance name — makes prompts easier)
sudo hostnamectl set-hostname web-1

# Set timezone
sudo timedatectl set-timezone America/New_York   # or your zone

# Reboot to pick up any kernel updates
sudo reboot

Wait 30 seconds, SSH back in.

Sanity check the network¶

ip -br a           # should show ens3 (or similar) with a private IP
curl -s ifconfig.me
                   # should return your public IP
sudo ss -tlnp      # what's listening

The AMD Micro's ens3 interface has a private IP from the subnet CIDR (e.g., 10.0.0.55/24). The public IP is 1:1 NAT'd at OCI's edge — you'll never see it inside the VM. That's normal.

Firewall reality check¶

Ubuntu 24.04 images on OCI ship with iptables rules already in place that mirror the VCN's ingress list (SSH open, everything else blocked). Check:

sudo iptables -L INPUT -v -n

You'll see rules allowing 22, but not yet 80 and 443. Those need to be opened locally too, or Caddy won't be reachable even though the OCI ingress list allows them.

The cleanest way is to replace iptables with nftables — see SSH and hardening — and open 80/443 there. Or just add allow rules with iptables for now:

sudo iptables -I INPUT 6 -p tcp -m tcp --dport 80  -j ACCEPT
sudo iptables -I INPUT 6 -p tcp -m tcp --dport 443 -j ACCEPT
sudo netfilter-persistent save

We'll come back to this properly during hardening.

Repeat for `web-2` (optional now)¶

If you want your second AMD Micro right away, repeat the same flow with a different instance name. Otherwise, you can add it later.

Next¶

Head to Provision the ARM Ampere to spin up your 24 GB workhorse.