Why Not a Spare Machine?
I don’t have one. Buying hardware for a learning project adds cost without adding much learning value. Cloud VMs teach the same skills (networking, firewalls, user management, service configuration), and they come with the added challenge of dealing with cloud-specific networking layers.
Oracle Cloud’s Always Free Tier
OCI offers an ARM-based Ampere A1 instance on their permanently free tier. The specs are generous for a personal project: multiple OCPUs, plenty of RAM, ample block storage, and a large monthly outbound transfer allowance. It costs nothing, permanently. No trial period, no credit card surprises.
The ARM architecture means packages are aarch64 instead of x86_64. In practice this rarely matters, since almost everything in the Oracle Linux repos ships ARM builds. But it’s worth knowing if you’re compiling from source or pulling container images.
Why Oracle Linux?
Oracle Linux is Oracle’s RHEL rebuild: same package manager (dnf), same init system (systemd), same SELinux policies, same directory conventions as Red Hat Enterprise Linux. Free to use, and on Oracle Cloud it’s the first-party choice, which means the cloud-init hooks, OCI utilities, and provider integrations are preconfigured out of the box.
This matters because enterprise environments run RHEL, CentOS, Rocky, AlmaLinux, or Oracle Linux, all of them the same skill set under different branding. Learning on Ubuntu is fine, but the skills don’t transfer one-to-one. File paths differ, service management has quirks, firewall tooling is different (ufw vs firewalld). Oracle Linux means the commands I practice here are the same ones I’d use in a production data center that runs anything in the RHEL family.
One Principle From Day One
When OCI offered to generate an SSH keypair during instance creation, I declined. I uploaded my own public key instead.
The reasoning: a private key should never exist on any machine other than mine. Not even briefly, not even encrypted in transit. If a third party generates it and sends it to you, you’re trusting their infrastructure, their memory management, their cleanup processes. The only way to be certain no copy exists elsewhere is to generate it yourself and never let it leave your machine.
This is a small decision, but it reflects a principle that applies everywhere in this project: don’t trust defaults, and don’t delegate security decisions to convenience.