1Z0-1158-26 · Domain 5 of 6

1Z0-1158-26 Domain 5: Building and Deploying Hosted Agents

Running your own agent runtime on OCI-managed infrastructure for 1Z0-1158-26: packaging it as a container, defining a hosted application and its deployments, choosing endpoints and authentication, and using sandboxes.

Exam weight estimate
Not published
Official topics estimate
5
Estimated questions estimate
~7
Suggested study time estimate
10–14 hrs

About 11 min read Reviewed October 2026

Overview

Domain 5 covers the second agent approach in OCI Enterprise AI: hosted agentic applications. Instead of relying only on the Responses API, you package your own agent runtime, built with any framework, as a container image, push it to OCI Container Registry and run it on OCI-managed infrastructure. The model has two resources. An application defines scaling behaviour, managed storage such as File Storage, OCI PostgreSQL, OCI Cache or Autonomous Database, the VCN and subnet, a public or private endpoint, and inbound authentication.

A deployment points at a specific container image and inherits those application settings, and the active deployment serves traffic through the application endpoint. The section also covers sandboxes, which are short-lived Linux workspaces for running code and commands, and hybrid designs in which a hosted runtime calls the Responses API for model interaction, tools, memory and NL2SQL.

How it's tested

Hosted agent questions usually describe an existing agent codebase and constraints on network exposure, identity, state or scaling, then ask which application setting, deployment step or authentication option meets them. Some ask you to put the deployment workflow in order or pick between hosting and the Responses API alone.

  • Application or deployment

    You decide whether a setting such as scaling, storage, endpoint type or image version belongs to the application or the deployment.

  • Exposure and identity

    Internal-only or user-facing requirements point to private or public endpoints and to identity domain, IAM or no platform authentication.

  • Where code runs

    You choose between Responses API tools, a hosted runtime and a sandbox for a given piece of agent work.

Reasoning it through

A team has a LangGraph agent that must serve employees only, sign them in with corporate SSO and keep session state between requests. A hosted application with a private endpoint in their VCN limits exposure. Identity domain authentication through a registered identity domain application provides SSO, and OCI Cache or PostgreSQL storage holds state. Running only Responses API calls would not host their existing graph code.

Topics 5

Official topics from the Oracle outline, in outline order.

5.1 Package agent runtimes as container imagesBuilding and storing images for hosted agents.
What it means
A hosted agent is your own runtime, written with any framework or language, built into a container image. The image is pushed to OCI Container Registry, where a deployment can reference it.
What to understand
Packaging gives you control over libraries, orchestration logic and long-running behaviour that a pure API approach cannot express. Keep images small and versioned so each deployment refers to a known build. Secrets should not be baked into images; supply them through platform configuration and authentication. The typical sequence is build, push to OCI Container Registry, create the application, create a deployment pointing to the image, then activate it.
How it shows up
Expect to order the steps from image build to an active deployment.
Common confusion
Thinking hosted agents must be written with a specific Oracle framework.
5.2 Configure hosted applicationsScaling, managed storage, networking and endpoints.
What it means
An application is the hosted configuration that deployments run inside. It sets deployment scaling behaviour, managed storage, the VCN and subnet, whether the endpoint is public or private, and the inbound authentication option.
What to understand
Managed storage choices include File Storage, OCI PostgreSQL, OCI Cache and Oracle Autonomous Database, letting stateful agents persist sessions, files or results. Private endpoints keep traffic inside your network, which suits internal tools. Autoscaling handles variable load without manual changes. Because deployments inherit these settings, changing the application affects every deployment it runs.
How it shows up
A scenario lists exposure, state and load needs and asks which application settings to choose.
Common confusion
Configuring scaling or endpoint type on each deployment rather than on the application.
5.3 Create and manage deploymentsRunning a specific image version through the application endpoint.
What it means
A deployment points to one container image in OCI Container Registry and runs it under its application. When a deployment is active, it serves requests through the application endpoint.
What to understand
Deployments inherit autoscaling, storage, networking and authentication from the application, so they mainly carry the image reference. Releasing a new version of agent code means creating a deployment for the new image and making it active, which keeps an earlier deployment available as a rollback reference. Monitor health after activation, since a broken image fails at run time rather than at creation.
How it shows up
Questions ask how to roll out or roll back a new agent version.
Common confusion
Assuming pushing a new image tag updates the running deployment automatically.
5.4 Configure authentication for hosted agentsInbound and outbound identity options.
What it means
Hosted applications support several inbound authentication options: identity domain bearer token, identity domain browser session, OCI IAM, or no platform-managed authentication when the runtime handles it itself.
What to understand
Token and browser session options require registering an OCI identity domain application, a custom application in OCI IAM that supports SSO and identity propagation using OAuth. OCI IAM suits service-to-service callers inside OCI. Choosing no platform authentication shifts responsibility to your code and should be a deliberate decision. Outbound calls from the runtime, for example to the Responses API, need their own OCI credentials, ideally resource-based IAM rather than stored keys.
How it shows up
Expect a scenario requiring corporate SSO for a browser-based agent and asking what to configure.
Common confusion
Picking OCI IAM for end users signing in through a browser, or forgetting the identity domain application.
5.5 Use sandboxes and hybrid architecturesTemporary workspaces and combining hosted runtimes with the Responses API.
What it means
A sandbox is a managed, temporary Linux workspace with its own filesystem, network namespace and process space. An application creates one with a compute shape and expiry, uploads files, runs commands, collects results and stops it.
What to understand
Sandboxes belong to a project that holds their networking configuration. A sandbox ID lets later workflow steps address the same running workspace, and snapshots save files to seed a new sandbox. In a hybrid architecture, the hosted runtime handles custom orchestration while calling the Responses API for model interaction, tools, project memory and NL2SQL, and stores durable results in managed storage rather than in the sandbox.
How it shows up
A question asks where an agent should run untrusted shell commands or where to keep results that must outlive a sandbox.
Common confusion
Treating a sandbox as durable storage that survives its expiry.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Hosted agentic application

    Your packaged agent runtime running on OCI-managed infrastructure.

    Remember
    Two resources: application and deployment.
    Tested as
    Approach choice questions.
    Trap
    Confusing it with a Responses API call.

  • Application

    Defines scaling, storage, networking, endpoint and auth.

    Remember
    Settings are inherited by deployments.
    Tested as
    Configuration placement questions.
    Trap
    Setting these per deployment.

  • Deployment

    Runs a specific container image under an application.

    Remember
    The active deployment serves the endpoint.
    Tested as
    Rollout and rollback questions.
    Trap
    Expecting image tag pushes to auto-update.

  • OCI Container Registry

    Stores the container images deployments use.

    Remember
    Push the image before creating a deployment.
    Tested as
    Workflow order questions.
    Trap
    Pointing at an external registry by default.

  • Managed storage

    File Storage, OCI PostgreSQL, OCI Cache or Autonomous Database.

    Remember
    Holds state that must persist.
    Tested as
    Stateful agent scenarios.
    Trap
    Keeping state in container memory.

  • Private endpoint

    Application endpoint reachable only inside your network.

    Remember
    Fits internal users and systems.
    Tested as
    Exposure scenarios.
    Trap
    Choosing public for internal tools.

  • Identity domain application

    Custom OAuth app in OCI IAM for SSO and identity propagation.

    Remember
    Needed for bearer token or browser session auth.
    Tested as
    End-user sign-in questions.
    Trap
    Skipping registration.

  • No platform-managed authentication

    Inbound option where your runtime handles auth.

    Remember
    Shifts responsibility to your code.
    Tested as
    Security trade-off questions.
    Trap
    Picking it for convenience.

  • Sandbox

    Temporary Linux workspace with its own filesystem and network namespace.

    Remember
    Created with a shape and expiry.
    Tested as
    Code execution scenarios.
    Trap
    Treating it as durable.

  • Snapshot

    Saved sandbox files used to start a new sandbox.

    Remember
    Reuses prepared environments.
    Tested as
    Workflow continuity questions.
    Trap
    Confusing it with an image in the registry.

  • Hybrid architecture

    Hosted runtime plus Responses API services.

    Remember
    Custom orchestration with managed tools and memory.
    Tested as
    Design choice questions.
    Trap
    Rebuilding tools the API already provides.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Responses API versus hosted applications

ConceptMeaningKey differenceCommon trap
Responses API only OCI runs model calls, tools and memory Fastest path, no runtime to host Trying to run custom framework code
Hosted application Your container runs the agent logic Full control of code and state Rebuilding managed tools by hand
Hybrid Hosted runtime calls Responses API Custom orchestration plus managed services Missing outbound credentials

Inbound authentication options

ConceptMeaningKey differenceCommon trap
Identity domain bearer token OAuth token from an identity domain application Fits API clients acting for users No identity domain app registered
Identity domain browser session SSO sign-in for browser users Fits interactive web front ends Using it for machine callers
OCI IAM OCI request signing and policies Fits OCI services and tooling Expecting employee SSO
No platform-managed auth Runtime enforces its own checks Full responsibility in your code Leaving a public endpoint open

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Push updates the agent

    What candidates pick
    Push a new image tag and expect the running agent to change.
    Why it looks right
    Many platforms watch tags.
    Why it's wrong
    A deployment references a specific image; you create and activate a deployment for the new version.

    Clue to watch for The scenario asks how to release or roll back code.

  2. Per-deployment networking

    What candidates pick
    Set the VCN and endpoint type on each deployment.
    Why it looks right
    Deployments feel like the runtime unit.
    Why it's wrong
    Networking, endpoint, storage, scaling and auth are application settings inherited by deployments.

    Clue to watch for Several deployments must share one configuration.

  3. OCI IAM for employee SSO

    What candidates pick
    Use OCI IAM inbound auth for staff signing in through a browser.
    Why it looks right
    IAM is the familiar OCI identity layer.
    Why it's wrong
    Browser SSO uses the identity domain browser session option with a registered identity domain application.

    Clue to watch for Mentions of single sign-on or a web portal.

  4. Sandbox as storage

    What candidates pick
    Keep final reports in the sandbox filesystem.
    Why it looks right
    Files are already there.
    Why it's wrong
    Sandboxes are temporary and expire; write durable results to managed storage, and use snapshots only to seed new sandboxes.

    Clue to watch for Results must be available days later.

  5. Host everything

    What candidates pick
    Rebuild file search and code execution inside the container.
    Why it looks right
    Full control seems safer.
    Why it's wrong
    Responses API tools already provide these; a hybrid design reuses them and reduces code to maintain.

    Clue to watch for The team wants less operational effort.

Answer framework

Follow these steps when planning a hosted agent deployment on OCI Enterprise AI.

  1. Decide whether the agent needs custom runtime code; if not, the Responses API alone may be enough, otherwise plan a hosted or hybrid design.
  2. Build a versioned container image of the runtime and push it to OCI Container Registry without embedding secrets.
  3. Create the application with scaling, managed storage, VCN and subnet, public or private endpoint, and the inbound authentication option.
  4. Create a deployment pointing to the image, activate it, verify health, and keep the earlier deployment as a rollback reference.
  5. Use sandboxes for isolated code or shell work, store durable state in managed storage, and call the Responses API for managed tools.

Practice question

An insurer containerises an existing agent built with an open source framework. Only employees on the corporate network may use it, through a browser with company SSO. Which hosted application settings fit?

Want more like this? The 1Z0-1158-26 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Read Oracle's hosted applications documentation first and draw two boxes: application and deployment. List every setting under the correct box, because many questions in this section simply test that placement. Add the six-step flow from image build to active deployment underneath.

If you have a tenancy, containerise a minimal agent, even a small Python web service that calls the Responses API, push it to OCI Container Registry and deploy it with a private endpoint. Then create a second deployment for a changed image and switch between them so rollout and rollback feel concrete. If you cannot deploy, walk through the console screens and API reference instead.

For authentication, build a short table of the four inbound options with a typical caller for each, and note when an identity domain application must be registered. Add a row for outbound credentials. Finally, read the sandbox section and write two example workflows: one that keeps results in managed storage and one that uses a snapshot. Practice scenarios that mix network exposure and identity, since those combine several facts in one item.

FAQ

How much of 1Z0-1158-26 is Domain 5, Building and Deploying Hosted Agents?

Oracle does not publish weights. Third-party practice banks give this section about a seventh of items, focused on configuration and deployment scenarios.

Do hosted agents need an Oracle framework?

No. You package any runtime as a container image. Many teams use open source agent frameworks and call OCI services from inside the container.

Where do I set autoscaling?

On the application. Deployments inherit scaling, storage, networking and authentication from it.

How do I release a new agent version?

Push the new image, create a deployment that points to it and make that deployment active. The previous deployment remains for rollback.

What storage can a hosted agent use?

Managed options include File Storage, OCI PostgreSQL, OCI Cache and Oracle Autonomous Database, chosen on the application.

What is a sandbox for?

Running code or shell commands in a temporary, isolated Linux workspace. Keep lasting results in managed storage, since sandboxes expire.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered container packaging, applications, deployments, endpoints, inbound authentication, sandboxes and hybrid designs. Check how you place settings and choose auth options.

Take the 1Z0-1158-26 practice test Check your 1Z0-1158-26 readiness

Keep going