Oracle Cloud Infrastructure Documentation

Configuring File Storage Access for an IoT Flow Runtime

Add up to 5 File Storage mounts to an IoT flow runtime's network configuration.

When you create or update the Flow Runtime, you can optionally add File Storage mounts to its network configuration so that Node-RED flows can access files in OCI File Storage.

Choosing File Storage or Object Storage

Choose the storage service based on how the flow needs to access and process the files.

Storage optionUse whenAccess and requirements
File StorageThe flow needs shared files available through ordinary filesystem paths.Configure a mount in the Flow Runtime networkConfig or using the Console steps below. The export remains available at a mounted filesystem path under /mnt/ while configured and requires a file system, mount target, export, and NFS network access.
Object StorageThe flow processes discrete batch or archive objects retrieved by namespace, bucket, and object name.Configure the Object Storage node with a resource principal. Each object is downloaded through the service API and requires a bucket, dynamic group, IAM policy, and network reachability. See Ingesting Batch Data from Object Storage for an example.
File Storage exports are always mounted under /mnt/. Supply only a relative mount path, such as history.
Note

The system rejects a leading slash, a trailing slash, and path traversal segments so that an export can't be mounted over system locations such as /, /etc, /usr, /var, /dev, or /proc.
Important

Data in a configured File Storage file system is retained when you deactivate and reactivate the Flow Runtime. The Flow Runtime's local file system is ephemeral, and files on it might be lost during deactivation or activation. Move required local files to File Storage, Object Storage, Autonomous Database, or another persistent storage service before performing either lifecycle action.

Before You Begin

  1. Create a file system, mount target, and export. Place the mount target in a subnet that the Flow Runtime subnet can reach.

  2. On the export details page, edit the NFS client Export options and set Ports to Privileged. See Editing an Export and Export Options.

Use a network security group (NSG) for the mount target when possible. If you don't use an NSG, add the following stateful ingress rules to the security list associated with the mount target subnet. These ports match the File Storage mount requirements for Container Instances. For other network placements and complementary egress rules, see Configuring VCN Security Rules for File Storage.

File Storage ingress rules for a Flow Runtime
SourceProtocolDestination port
Flow Runtime subnet CIDRTCP111
Flow Runtime subnet CIDRUDP111
Flow Runtime subnet CIDRTCP2048-2051
Flow Runtime subnet CIDRUDP2048-2051
    1. On the IoT domains list page, select the domain with the Flow Runtime you want to work with, and then select Flow runtimes. If you need help finding the IoT domains list page, see Listing IoT Domains.
    2. Select the Flow Runtime name to open the details page, and then select Edit.
    3. Turn on Configure file storage mounts. Select the File system export compartment and File system export.
    4. For Mount path, enter only the relative portion, for example my-share. Don't enter a leading or trailing slash or path traversal segments.

      The Console displays /mnt/ as a fixed, non-editable prefix and sends "mountPath": "my-share" to the API. The export is available to the Flow Runtime at /mnt/my-share.

    5. To configure another export, select Add file storage mount and repeat the preceding steps. You can configure up to five File Storage mounts.
    6. Select Save changes and wait for the update to complete.

  • Create a complete network configuration file that can include up to 5 File Storage mounts, and then run the generated IoT Flow Runtime update command.

    oci iot flow-runtime update --iot-flow-runtime-id <flow-runtime-OCID> --network-config file://network-config.json

    For example, network-config.json contains:

    {
  "subnetId": "ocid1.subnet.oc1..exampleuniqueID",
  "networkSecurityGroupIds": [
    "ocid1.networksecuritygroup.oc1..exampleuniqueID"
  ],
  "fileStorageMounts": [
    {
      "mountPath": "history",
      "mountTargetId": "ocid1.mounttarget.oc1..exampleuniqueID",
      "exportId": "ocid1.export.oc1..exampleuniqueID"
    }
  ]
}

    The mountPath value is relative. This example makes the export available to the Flow Runtime at /mnt/history.

    Providing --network-config replaces the complete network configuration. To remove all File Storage mounts while preserving the VCN attachment, provide a replacement object that omits fileStorageMounts.

    For all options, see CLI Command Reference.

  • Run the UpdateIotFlowRuntime operation to configure File Storage access by using a complete replacement networkConfig that contains fileStorageMounts.

    PUT /20250531/iotFlowRuntimes/{iotFlowRuntimeId}
{
  "networkConfig": {
    "subnetId": "ocid1.subnet.oc1..exampleuniqueID",
    "networkSecurityGroupIds": [
      "ocid1.networksecuritygroup.oc1..exampleuniqueID"
    ],
    "fileStorageMounts": [
      {
        "mountPath": "history",
        "mountTargetId": "ocid1.mounttarget.oc1..exampleuniqueID",
        "exportId": "ocid1.export.oc1..exampleuniqueID"
      }
    ]
  }
}

    The mountPath value is relative. This example makes the export available to the Flow Runtime at /mnt/history.

    When supplied, fileStorageMounts must contain at least one item. Each item requires mountPath, mountTargetId, and exportId. The mountPath value must not have a leading slash, trailing slash, or path traversal segments.

    Updates are partial, but a supplied networkConfig replaces the complete network configuration. Omit fileStorageMounts from the replacement object to remove all mounts. Omit networkConfig from the update request to preserve the complete existing network configuration.