Fix issues found in second independent review

- run_job(): source reservation/security_group from the `requirements`
  parameter (already fleet+run-combined) instead of job.job_spec.requirements
  (run-only). Without this, a run provisioning new capacity into a fleet with
  a fleet-level security_group/reservation would silently ignore it - the same
  latent bug reservation already had, inherited by security_group.

- Azure create_gateway(): use get_gateway_network_security_group_name (the
  dedicated, always-created gateway NSG) instead of
  get_default_network_security_group_name. The default/per-location instance
  NSG can now be skipped when network_security_group_names covers that
  location, which would have broken gateway provisioning since it was
  referencing an NSG that might not exist.

- OCI: redesign custom-NSG networking. The previous "separate restricted VCN"
  approach is fundamentally broken - OCI network security groups are
  VCN-scoped, so a user's NSG can never be attached to an instance in a
  different VCN than the one the NSG lives in. Fixed by using a single shared
  subnet for all instances (default-NSG and custom-NSG alike), with no OCI
  security list attached. dstack's auto-managed NSG now carries explicit SSH
  ingress and all-egress rules to compensate for the removed security list;
  custom NSGs remain fully hands-off, per the feature's contract. Existing
  subnets are migrated in place (security list detached) since the subnet is
  dstack-owned infrastructure, not a user-supplied resource. Updated docs to
  clarify a custom NSG must live in dstack's own default VCN.

Regression: 388 core backend tests + base/azure/oci targeted suites +
server routers/services (requirements, offers, fleets, runs, backends) all
passing. Pre-existing unrelated failures (verda/vastai/nebius modules not
installed in this environment) left untouched.

Author: james-boydell

mkdocs/docs/concepts/backends.md

@@ -1162,12 +1162,11 @@ There are two ways to configure OCI: using client credentials or using the defau
     ```
 
 ??? info "Custom network security group"
-    By default, `dstack` places instances in a shared subnet whose OCI security list opens SSH
-    (TCP port 22) to `0.0.0.0/0` and permits all outbound traffic. On top of that, `dstack` creates
-    and manages its own network security group (NSG) per project, which only adds a rule allowing all
-    traffic within the group so multi-node clusters work out of the box. In other words, the
-    permissive SSH ingress and the outbound access come from the subnet's security list, not from the
-    auto-managed NSG.
+    By default, `dstack` places instances in a shared subnet that has **no** OCI security list
+    attached. On top of that, `dstack` creates and manages its own network security group (NSG) per
+    project, which grants everything instances need: SSH ingress (TCP port 22) from `0.0.0.0/0`,
+    unrestricted egress, and — so multi-node clusters work out of the box — all traffic between
+    instances in the group.
 
     OCI network security groups are region-scoped, so a custom NSG is configured per region via
     `network_security_group_ids`:
@@ -1185,14 +1184,16 @@ There are two ways to configure OCI: using client credentials or using the defau
     ```
 
     Regions not covered by `network_security_group_ids` fall back to dstack's auto-created network
-    security group and shared subnet.
-
-    When a custom NSG is used, `dstack` never adds, removes, or modifies its rules, and it places the
-    affected instances in a separate VCN and subnet that has **no** OCI security list (a second subnet
-    in the same VCN isn't possible here, since the default subnet already occupies the whole VCN's
-    address space). This makes the NSG the sole security boundary — there is no longer any implicit
-    SSH-from-anywhere or implicit outbound-all coming from a security list. As a result, your custom
-    NSG is fully responsible for:
+    security group.
+
+    OCI requires a network security group to belong to the same VCN as the instances it's attached
+    to. Since `dstack` provisions instances into its own default VCN per project
+    (`dstack-<project>-default-vcn`), your custom NSG must be created in that VCN.
+
+    When a custom NSG is used, `dstack` never adds, removes, or modifies its rules. Because the shared
+    subnet has no security list, the NSG is the sole security boundary for these instances — there is
+    no implicit SSH-from-anywhere or implicit outbound-all falling back from a security list. As a
+    result, your custom NSG is fully responsible for:
 
     - **Ingress**, including SSH (TCP port 22) from wherever you connect.
     - **Egress**, including outbound internet access. Without an egress rule (e.g. allow all to

src/dstack/_internal/core/backends/azure/compute.py

@@ -262,7 +262,12 @@ def create_gateway(
             location=configuration.region,
             allocate_public_ip=True,
         )
-        network_security_group = azure_utils.get_default_network_security_group_name(
+        # Gateways always use the dedicated gateway NSG (created unconditionally in
+        # `_create_network_resources`, regardless of `network_security_group_names`),
+        # never the per-location default/custom instance NSG. This keeps gateway
+        # provisioning working even for locations where the default instance NSG is
+        # skipped because a custom one is configured for instances.
+        network_security_group = azure_utils.get_gateway_network_security_group_name(
             resource_group=self.config.resource_group,
             location=configuration.region,
         )

src/dstack/_internal/core/backends/base/compute.py

@@ -320,8 +320,8 @@ def run_job(
             user=run.user,
             ssh_keys=[SSHKey(public=project_ssh_public_key.strip())],
             volumes=volumes,
-            reservation=job.job_spec.requirements.reservation,
-            security_group=job.job_spec.requirements.security_group,
+            reservation=requirements.reservation,
+            security_group=requirements.security_group,
             tags=run.run_spec.merged_profile.tags,
         )
         instance_offer = instance_offer.copy()

src/dstack/_internal/core/backends/oci/compute.py

@@ -135,6 +135,13 @@ def create_instance(
             listing, self.config.compartment_id, region.marketplace_client
         )
 
+        # All instances - whether using dstack's auto-managed NSG or a custom
+        # one - share the same subnet. This is required because OCI NSGs are
+        # VCN-scoped: an NSG can only be attached to a VNIC whose subnet
+        # belongs to the same VCN the NSG lives in, and dstack only manages
+        # one VCN per project. The subnet has no security list attached (see
+        # `get_or_create_subnet`), so the NSG attached to each instance is its
+        # sole security boundary.
         subnet: oci.core.models.Subnet = region.virtual_network_client.get_subnet(
             self.config.subnet_ids_per_region[instance_offer.region]
         ).data
@@ -143,8 +150,7 @@ def create_instance(
             security_group_id = self.config.network_security_group_ids.get(
                 instance_offer.region
             )
-        using_custom_security_group = security_group_id is not None
-        if not using_custom_security_group:
+        if security_group_id is None:
             security_group = resources.get_or_create_security_group(
                 f"dstack-{instance_config.project_name}-default-security-group",
                 subnet.vcn_id,
@@ -155,25 +161,10 @@ def create_instance(
                 security_group.id, region.virtual_network_client
             )
             security_group_id = security_group.id
-            firewall_allow_from_subnet = resources.VCN_CIDR
-        else:
-            # A user-managed (custom) NSG is in use. Place the instance in a
-            # dedicated VCN/subnet that has no OCI security list, so the NSG is
-            # the sole security boundary. This is a *separate* VCN, not a second
-            # subnet in the default one: the default subnet already occupies the
-            # default VCN's entire CIDR block, so a second subnet there would
-            # conflict. The default VCN/subnet is left completely untouched,
-            # so instances using dstack's auto-managed NSG are unaffected.
-            subnet = resources.set_up_restricted_network_resources_in_region(
-                compartment_id=self.config.compartment_id,
-                project_name=instance_config.project_name,
-                client=region.virtual_network_client,
-            )
-            firewall_allow_from_subnet = resources.RESTRICTED_VCN_CIDR
 
         cloud_init_user_data = get_user_data(
             authorized_keys=instance_config.get_public_keys(),
-            firewall_allow_from_subnets=[firewall_allow_from_subnet],
+            firewall_allow_from_subnets=[resources.VCN_CIDR],
         )
 
         display_name = generate_unique_instance_name(instance_config)

src/dstack/_internal/core/backends/oci/models.py

@@ -77,12 +77,17 @@ class OCIBackendConfig(CoreModel):
                 " use for instances instead of the one `dstack` creates and manages automatically."
                 " Regions not present in this mapping fall back to dstack's auto-created network"
                 " security group."
+                " Because OCI requires a network security group to belong to the same VCN as the"
+                " instances it's attached to, and `dstack` provisions instances into its own"
+                " default VCN for each project, the network security group must be created in that"
+                " VCN (named `dstack-<project>-default-vcn`)."
+                " `dstack`'s default subnet in that VCN has no OCI security list attached, so"
+                " whichever network security group is attached to an instance - yours or dstack's"
+                " own - is the sole security boundary for it."
                 " When set, `dstack` does not add, remove, or modify any rules on these network"
-                " security groups, and it places the affected instances in a separate subnet that"
-                " has no OCI security list, so the network security group becomes the sole security"
-                " boundary. You are fully responsible for the network security group's rules,"
-                " including ingress (e.g. SSH), egress (e.g. outbound access to pull Docker images),"
-                " and, for multi-node clusters, traffic between instances in the group"
+                " security groups. You are fully responsible for their rules, including ingress"
+                " (e.g. SSH), egress (e.g. outbound access to pull Docker images), and, for"
+                " multi-node clusters, traffic between instances in the group"
             )
         ),
     ] = None

src/dstack/_internal/core/backends/oci/resources.py

@@ -38,9 +38,6 @@
 ADD_SECURITY_RULES_MAX_CHUNK_SIZE = 25
 LIST_OBJECTS_MAX_LIMIT = 1000
 VCN_CIDR = "10.0.0.0/16"
-# CIDR for the dedicated VCN used for custom-NSG instances (see `get_or_create_restricted_vcn`).
-# Must not overlap `VCN_CIDR` in case the two VCNs are ever peered.
-RESTRICTED_VCN_CIDR = "10.1.0.0/16"
 WAIT_FOR_COMPARTMENT_ATTEMPS = 36
 WAIT_FOR_COMPARTMENT_DELAY = 5
 
@@ -559,75 +556,52 @@ def get_or_create_vcn(
 def get_or_create_subnet(
     name: str, vcn_id: str, compartment_id: str, client: oci.core.VirtualNetworkClient
 ) -> oci.core.models.Subnet:
-    query_results = chain_paginated_responses(
-        client.list_subnets, compartment_id=compartment_id, display_name=name
-    )
-    if subnet := next(query_results, None):
-        return subnet
-
-    return client.create_subnet(
-        oci.core.models.CreateSubnetDetails(
-            cidr_block=VCN_CIDR,
-            compartment_id=compartment_id,
-            display_name=name,
-            vcn_id=vcn_id,
-        )
-    ).data
-
-
-def get_or_create_restricted_vcn(
-    name: str, compartment_id: str, client: oci.core.VirtualNetworkClient
-) -> oci.core.models.Vcn:
     """
-    Like `get_or_create_vcn`, but a separate VCN (own CIDR block) dedicated to
-    custom-NSG instances. A *separate* VCN is used - rather than a second subnet
-    in the existing default VCN - because the default subnet already occupies
-    the default VCN's entire CIDR block, and adding a second CIDR block to an
-    existing VCN requires an async OCI operation (`add_vcn_cidr`) that takes
-    the VCN out of service for subnet/route-table updates for its duration.
-    A brand new VCN avoids that entirely and keeps the default VCN/subnet used
-    by dstack's auto-managed instances completely untouched.
-    """
-    query_results = chain_paginated_responses(
-        client.list_vcns, compartment_id=compartment_id, display_name=name
-    )
-    if vcn := next(query_results, None):
-        return vcn
-
-    return client.create_vcn(
-        oci.core.models.CreateVcnDetails(
-            cidr_blocks=[RESTRICTED_VCN_CIDR],
-            compartment_id=compartment_id,
-            display_name=name,
-        )
-    ).data
-
-
-def get_or_create_restricted_subnet(
-    name: str, vcn_id: str, compartment_id: str, client: oci.core.VirtualNetworkClient
-) -> oci.core.models.Subnet:
-    """
-    Like `get_or_create_subnet`, but creates the subnet with an empty list of
-    security lists (`security_list_ids=[]`) instead of letting OCI attach the
-    VCN's permissive default security list. Must be created in a VCN returned
-    by `get_or_create_restricted_vcn`, not the default VCN.
-
-    This is used for instances that run with a user-managed (custom) network
-    security group. With no security list contributing rules, the NSG becomes
-    the sole source of truth for what traffic is allowed to and from these
-    instances. OCI evaluates security lists and NSGs as a union of allows, so an
-    empty security list list simply means "the security-list layer grants
-    nothing"; it does not deny anything on its own.
+    The subnet is created with an empty list of security lists
+    (`security_list_ids=[]`) instead of letting OCI attach the VCN's permissive
+    default security list. All instances - whether they use dstack's
+    auto-managed network security group (NSG) or a user-supplied custom one -
+    live in this single shared subnet, so the NSG attached to each instance's
+    VNIC is the sole security boundary; there is no separate security-list
+    layer to reason about.
+
+    A single shared subnet (rather than a second, NSG-only subnet) is required
+    because OCI NSGs are scoped to a single VCN: an NSG can only be attached to
+    a VNIC whose subnet belongs to the *same* VCN the NSG was created in. Since
+    dstack only manages one VCN, a user's custom NSG must live in - and a
+    custom-NSG instance must therefore be placed in a subnet within - that same
+    VCN.
+
+    For instances using dstack's auto-managed NSG, the rules normally
+    contributed by the security list (SSH ingress, unrestricted egress) are
+    added directly to that NSG instead; see
+    `update_security_group_rules_for_runner_instances`. Instances using a
+    user-supplied NSG get no such compensating rules - per dstack's "fully
+    hands-off" contract, it never adds, removes, or otherwise modifies rules on
+    a user-supplied security group, so the user is fully responsible for
+    allowing the traffic their instances need (including SSH).
     """
     query_results = chain_paginated_responses(
         client.list_subnets, compartment_id=compartment_id, display_name=name
     )
     if subnet := next(query_results, None):
+        if subnet.security_list_ids:
+            # A subnet created before this fix still has the VCN's default
+            # security list attached. Since dstack owns this subnet
+            # (it is not user-supplied), it's safe to update it in place -
+            # detaching the security list so the NSG becomes the sole
+            # security boundary for every instance in it, matching newly
+            # created subnets. This is unrelated to dstack's "fully
+            # hands-off" contract for user-supplied *security groups*, which
+            # this does not touch.
+            subnet = client.update_subnet(
+                subnet.id, oci.core.models.UpdateSubnetDetails(security_list_ids=[])
+            ).data
         return subnet
 
     return client.create_subnet(
         oci.core.models.CreateSubnetDetails(
-            cidr_block=RESTRICTED_VCN_CIDR,
+            cidr_block=VCN_CIDR,
             compartment_id=compartment_id,
             display_name=name,
             vcn_id=vcn_id,
@@ -636,28 +610,6 @@ def get_or_create_restricted_subnet(
     ).data
 
 
-def set_up_restricted_network_resources_in_region(
-    compartment_id: str, project_name: str, client: oci.core.VirtualNetworkClient
-) -> oci.core.models.Subnet:
-    """
-    Like `set_up_network_resources_in_region`, but for the dedicated VCN/subnet
-    used by custom-NSG instances (see `get_or_create_restricted_vcn` and
-    `get_or_create_restricted_subnet`). Idempotent - safe to call on every
-    instance launch, mirroring how `get_or_create_security_group` is already
-    called on every launch for the default (non-custom-NSG) path.
-    """
-    vcn = get_or_create_restricted_vcn(
-        f"dstack-{project_name}-restricted-vcn", compartment_id, client
-    )
-    internet_gateway = get_or_create_internet_gateway(
-        f"dstack-{project_name}-restricted-internet-gateway", vcn.id, compartment_id, client
-    )
-    update_route_table(vcn.default_route_table_id, internet_gateway.id, client)
-    return get_or_create_restricted_subnet(
-        f"dstack-{project_name}-restricted-subnet", vcn.id, compartment_id, client
-    )
-
-
 def get_or_create_internet_gateway(
     name: str, vcn_id: str, compartment_id: str, client: oci.core.VirtualNetworkClient
 ) -> oci.core.models.InternetGateway:
@@ -714,8 +666,11 @@ def get_or_create_security_group(
 def update_security_group_rules_for_runner_instances(
     security_group_id: str, client: oci.core.VirtualNetworkClient
 ) -> None:
-    # These rules are combined with subnet's default Security List that allows
-    # ingress TCP on port 22 from anywhere
+    # The subnet these instances live in has no security list attached (see
+    # `get_or_create_subnet`), so this NSG must grant everything a runner
+    # instance needs on its own: SSH ingress from anywhere and unrestricted
+    # egress, in addition to allowing all traffic between instances that share
+    # this NSG.
     rules = [
         SecurityRule(
             description="Allow all traffic within this security group",
@@ -724,6 +679,23 @@ def update_security_group_rules_for_runner_instances(
             source=security_group_id,
             protocol="all",
         ),
+        SecurityRule(
+            description="Allow SSH ingress from anywhere",
+            direction=oci.core.models.AddSecurityRuleDetails.DIRECTION_INGRESS,
+            source_type=oci.core.models.AddSecurityRuleDetails.SOURCE_TYPE_CIDR_BLOCK,
+            source="0.0.0.0/0",
+            protocol="6",  # TCP
+            tcp_options=oci.core.models.TcpOptions(
+                destination_port_range=oci.core.models.PortRange(min=22, max=22)
+            ),
+        ),
+        SecurityRule(
+            description="Allow all egress traffic",
+            direction=oci.core.models.AddSecurityRuleDetails.DIRECTION_EGRESS,
+            destination_type=oci.core.models.AddSecurityRuleDetails.DESTINATION_TYPE_CIDR_BLOCK,
+            destination="0.0.0.0/0",
+            protocol="all",
+        ),
     ]
     update_security_group_rules(security_group_id, rules, client)