In Oracle Cloud Infrastructure (OCI), fault isolation is not just a software policy; it is baked into the physical and silicon layers of the data center. Oracle’s "Security-First" design focuses on preventing "blast radius" expansion—ensuring that a failure or security breach in one component cannot physically migrate to another.

Here is how Oracle handles fault isolation at the hardware level.

1. The "Off-Box" Control Plane (Physical Decoupling)

Most cloud providers run their management software (hypervisor) on the same CPU as your data. If a guest escapes the VM, they can theoretically reach the cloud’s "brains."

OCI uses Off-box Network Virtualization. They move the network and storage management onto a dedicated hardware card (a custom SmartNIC) outside the host server.

• Hardware Isolation: The host server (running your code) is physically separated from the network control plane.

• No Shared Memory: There is no shared memory or CPU state between the customer’s bare metal/VM environment and the Oracle-managed infrastructure.

• The Result: Even a total compromise of the host OS cannot "jump" to the network to sniff other customers' traffic.

2. Fault Domains (Anti-Affinity at the Rack Level)

Within a single Data Center (Availability Domain), OCI organizes hardware into Fault Domains (FDs). Each AD contains exactly three FDs.

• No Shared SPOFs: Each Fault Domain is a grouping of hardware that does not share single points of failure. This means different FDs have:

  • Independent Power Distribution Units (PDUs).

  • Separate Top-of-Rack (ToR) switches.

  • Physically distinct server racks.

• Staggered Maintenance: Oracle never performs maintenance on more than one FD in a region at the same time. If you deploy a cluster across all three FDs, at least two-thirds of your hardware is guaranteed to remain powered and unpatched during any maintenance window.

3. Hardware Root of Trust & Pristine Re-provisioning

To prevent "persistent" threats (like a rootkit hiding in the server’s BIOS), OCI implements a Hardware Root of Trust.

• Wipe and Reinstall: Every time a bare metal instance is released by a customer, OCI uses a specialized hardware agent to physically wipe the firmware and reinstall it from a "known-good" source.

• Silicon-level Verification: The hardware agent verifies the signature of every piece of firmware (BIOS, NIC, Disk Controllers) before the next customer touches the machine. This ensures that "hardware-level" infections cannot survive between tenancies.

4. The "Flat" Non-Blocking Network

OCI’s physical network uses a highly non-blocking Clos topology. Unlike traditional "hierarchical" networks where many servers funnel into a single core switch (a major fault point), OCI’s network is decentralized.

• Path Redundancy: Every server has multiple physical paths to reach any other server in the data center.

• Isolation by Design: The network uses specialized ACLs (Access Control Lists) at the hardware port level. If a server tries to "spoof" an IP address that doesn't belong to its physical port, the switch drops the packet at the hardware wire, not in software.

Summary of Isolation Layers