DCA Hardened Vector Database for Milvus — Support & Quick Start

At a glance

Quick start

This is the listing's usage information, verbatim. Every command in it is run by our QA on a freshly launched instance before an image version can publish, so the text and the tested procedure cannot drift apart.

After launch:

1. Connect over SSH as the opc user with the key you supplied at launch:

   ssh opc@<public-ip>

2. On first boot the image generates the root password and an instance-unique TLS certificate, then Milvus initializes (allow two to three minutes). Check both units and the health endpoint:

   sudo systemctl status milvus-firstboot milvus
   curl -s http://127.0.0.1:9091/healthz

3. Read the root password generated uniquely for this instance (root only):

   sudo cat /root/.milvus_default_credentials

4. Smoke-test the REST API over TLS (gRPC clients such as pymilvus use port 19530 with the same certificate and token "root:<password>"):

   curl -s --cacert /etc/milvus/tls/server.pem https://127.0.0.1:19540/v2/vectordb/collections/list -H "Authorization: Bearer root:<password>" -d '{}'

5. Create an account for your application, then rotate the root password (same --cacert and root Authorization header as step 4, POST to https://127.0.0.1:19540):

   /v2/vectordb/users/create          -d '{"userName":"appuser","password":"<strong-password>"}'
   /v2/vectordb/users/grant_role      -d '{"userName":"appuser","roleName":"admin"}'
   /v2/vectordb/users/update_password -d '{"userName":"root","password":"<current>","newPassword":"<new>"}'

6. Ports 19530 (gRPC) and 19540 (REST) are published on 127.0.0.1 only as shipped. To accept connections from your application tier, publish them on all interfaces and restart:

   sudo sed -i -e 's/^PublishPort=127.0.0.1:19530:19530$/PublishPort=19530:19530/' -e 's/^PublishPort=127.0.0.1:19540:19540$/PublishPort=19540:19540/' /etc/containers/systemd/milvus.container && sudo systemctl daemon-reload && sudo systemctl restart milvus

   Clients verify the server with /etc/milvus/tls/server.pem (its SAN lists the instance's private IPs), or install a CA-issued pair at /etc/milvus/tls/server.pem and server.key.

7. Restrict 19530 and 19540 in your VCN security list to your application tier's CIDR; never expose them to the internet. The management port 9091 (health and metrics only) stays on loopback.
8. Data (vectors, indexes and the embedded etcd metadata) lives in /var/lib/milvus. For anything beyond evaluation place it on a block volume; to back up, sudo systemctl stop milvus, copy /var/lib/milvus, then sudo systemctl start milvus.

The image is CVE-patched at build time. Apply ongoing operating system and Podman updates with:

sudo dnf -y update

Milvus itself runs from a container image pinned at build time and is refreshed by launching a newer image version of this listing.

What the image provides

• Milvus 2.6.25 from the project's official container image, pinned by its content digest at build time and run as a systemd service under Podman from the Oracle Linux 9 AppStream repository. Upstream's sample TLS private keys are removed from the image, so no key shared with every Milvus user ships.
• No MinIO: storage is local to the instance, so the image carries no AGPL-licensed object store.
• Authentication on by default: the root password is generated uniquely for this instance at first boot and surfaced to the operator over SSH — never a shared default credential.
• Encryption in transit: gRPC (19530) and REST (19540) both require TLS with an instance-unique certificate generated at first boot; the management port serves only health and metrics, on loopback.
• Safe-by-default network posture: every port is published on loopback until you expose it with one documented command; security hardening aligned to the Oracle Cloud Marketplace image standards — SELinux enforcing, host firewall default-deny with only SSH, 19530 and 19540 permitted, no account with a usable password, and the image fully patched at build time.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or use the contact form. Include the listing name, your OCI region, the instance OCID and the output of sudo journalctl -u <service> -n 100 for the unit named in the quick start.

Milvus™ is a trademark of LF Projects, LLC. This image is an independent hardened distribution and is not affiliated with, endorsed by, or sponsored by the Milvus project, LF AI & Data, The Linux Foundation, or Zilliz.