When creating an OCI Functions application for a permits webhook, which documented subnet pairing applies?
Select an answer to reveal the explanation.
Short Explanation
Public lane needs an internet gateway; private lane needs a service gateway so the function can still reach OCI services like the registry without a public IP. That pairing is how the function attaches—not a full VCN redesign homework.
Full Explanation
When creating an OCI Functions application for a permits webhook, documented subnet pairing is: public subnets need an internet gateway; private subnets need a service gateway so executions can reach OCI services such as the registry. Executions run in the application’s chosen subnets (one to three). Private executions still need a path to OCIR and other OCI services without requiring a public IP on the function—service gateway supplies that path.
Requiring a public IP on every function image layer in private subnets fails by concept because image layers are registry artifacts, not NIC addresses, and private Functions designs specifically avoid public addressing for execution. Claiming public subnets must disable all gateways to keep Functions cold-start free fails because gateways are about reachability, not a cold-start disable switch, and removing the internet gateway breaks the public-subnet model. Saying applications ignore subnets and attach only through Service Gateway DRG pairs fails because you do name subnets on the application; DRG redesign is not the developer attachment lesson here.
Exam caveat: picking private subnets without a service gateway (and needed routing/security rules) yields pulls and OCI API calls that fail at execution time even if deploy appeared to succeed. Operational check: for the permits application, verify the subnet type, confirm the matching gateway exists in the VCN, deploy a function that pulls from OCIR, and invoke successfully before production cutover.