Component	Version / Specification
Operating System	`RHEL / Rocky Linux / OL 8.x & 9.x, Ubuntu 22.04 LTS`
Database Target	`Oracle Database 19c / 23ai (CDB/PDB Architecture)`
Security Feature	`PDB Lockdown Profiles & Privilege Isolation`
Required Privileges	`SYSDBA / SYSOPER / PDB_DBA`

Multitenant Architecture: CDB/PDB Management, Cloning & Lockdown Profiles

1. Overview & Executive Summary

Oracle Multitenant is the default and only supported architecture in Oracle Database 23ai. The non-CDB architecture was deprecated in 20c and desupported in 23ai, making CDB/PDB management a mandatory skill for every enterprise DBA. This article delivers a production-ready playbook covering three critical pillars: CDB/PDB lifecycle management, cloning strategies (local, remote, snapshot, refreshable, and plug/unplug), and lockdown profiles for least-privilege PDB security.

The most common production failures we observe in the field are:

Clone operations failing with ORA-00600 — typically caused by the source PDB not being in a consistent state, missing FILE_NAME_CONVERT mappings, or corrupted PDB metadata in PDB$SEED.
Security exposures from missing lockdown profiles — PDBs deployed to production with default ALL privileges, leaving XDB protocols and UTL_HTTP open to attack (including known XDB protocol handler vulnerabilities).
Unplug/plug failures — attempting to plug a PDB into a CDB with incompatible COMPATIBLE settings or missing DBMS_PDB.CHECK_PLUG_COMPATIBILITY validation.

This guide provides a diagnostic checklist, a step-by-step resolution runbook, and official references to help you implement a robust, secure multitenant environment.

Process Flow

CDB Provisioning

→

PDB Creation

→

Lockdown Profile

→

↓

Clone / Refresh

→

Monitor & Audit

2. Diagnostic Checklist

Run these commands in order to assess the health of your multitenant environment before making any changes.

2.1 CDB / PDB Status

# Connect as SYSDBA
sqlplus / as sysdba

-- Check CDB status
SELECT name, cdb, open_mode, version FROM v$database;

-- Check all PDBs including PDB$SEED
SELECT pdb_id, pdb_name, status, open_mode, restricted
FROM dba_pdbs
ORDER BY pdb_id;

-- Check from container perspective
SELECT con_id, name, open_mode, restricted FROM v$pdbs;

Expected output: CDB open_mode = READ WRITE; PDBs should be READ WRITE or READ ONLY; restricted = NO for normal operation.

2.2 PDB$SEED Integrity

-- PDB$SEED must be in MOUNTED or READ ONLY state
SELECT con_id, name, open_mode FROM v$pdbs WHERE name = 'PDB$SEED';

-- Check seed file locations
SELECT name, con_id FROM v$datafile WHERE con_id = 2;

Expected output: PDB$SEED should be MOUNTED or READ ONLY. If it is READ WRITE, the CDB is in an invalid state.

2.3 Clone History & PDB Lineage

-- View PDB plug/unplug and clone history
SELECT pdb_name, operation, op_timestamp, cloned_from_pdb_name
FROM dba_pdb_history
ORDER BY op_timestamp DESC;

Expected output: Recent clone operations should show clean operation records. Failed operations will show ORA-00600 or other errors in the alert log.

2.4 Lockdown Profile Audit

-- List all lockdown profiles created in the CDB
SELECT profile_name FROM dba_lockdown_profiles;

-- Show active PDB lockdown parameter setting
SELECT name, value FROM v$parameter WHERE name = 'pdb_lockdown';

-- Inspect active lockdown profile rules
SELECT rule_type, rule, clause, status
FROM v$lockdown_rules;

Expected output: Production PDBs should have a active PDB_LOCKDOWN parameter configured. If the parameter is empty, the PDB is running with default privileges — a security risk.

2.5 Alert Log Scan for ORA-00600

# Locate the alert log
grep -i "ORA-00600" $ORACLE_BASE/diag/rdbms/*/*/trace/alert_*.log | tail -20

# Check for ORA-00600 in the last 24 hours
find $ORACLE_BASE/diag/rdbms -name "alert_*.log" -mtime -1 -exec grep -l "ORA-00600" {} \;

Expected output: No ORA-00600 entries. If present, note the full error signature (e.g., ORA-00600: internal error code, arguments: [kzmic_oc_2], ...) — you will need it for further research.

2.6 Plug Compatibility Pre-Check

-- Before plugging a PDB, validate compatibility
SET SERVEROUTPUT ON
DECLARE
  compatible BOOLEAN;
BEGIN
  compatible := DBMS_PDB.CHECK_PLUG_COMPATIBILITY(
    pdb_descr_file => '/backup/salespdb.xml',
    pdb_name       => 'SALESPDB_REPLUG'
  );
  IF compatible THEN
    DBMS_OUTPUT.PUT_LINE('Compatible: OK to plug.');
  ELSE
    DBMS_OUTPUT.PUT_LINE('NOT Compatible: Review PDB_PLUG_IN_VIOLATIONS.');
  END IF;
END;
/

-- Review violations if any
SELECT type, message, status FROM pdb_plug_in_violations;

Expected output: Compatible: OK to plug. or a list of violations to resolve.

3. Step-by-Step Resolution Runbook

Step 0: Safety Checks

Before any operation, verify the following:

Confirm a recent RMAN backup exists:

rman target /
RMAN> LIST BACKUP OF DATABASE SUMMARY;

Verify the maintenance window — cloning and plug/unplug operations require downtime for the source PDB in some cases. Confirm with your change management team.
Check current CDB/PDB state:

SELECT pdb_name, open_mode, restricted FROM dba_pdbs;

Review the alert log for recent errors:

tail -100 $ORACLE_BASE/diag/rdbms/*/*/trace/alert_*.log

Record the current COMPATIBLE setting:

SELECT name, value FROM v$parameter WHERE name = 'compatible';

Abort the runbook if any of the following are true:

No recent backup exists.

The CDB is in MIGRATE or UPGRADE mode.

PDB$SEED is in READ WRITE mode.

The alert log shows unresolved ORA-00600 errors.

Step 1: CDB/PDB Management

1.1 Create a PDB from PDB$SEED

CREATE PLUGGABLE DATABASE salespdb
  ADMIN USER sales_admin IDENTIFIED BY "S3cure!Pass"
  FILE_NAME_CONVERT = (
    '/opt/oracle/oradata/CDB1/pdbseed',
    '/opt/oracle/oradata/CDB1/salespdb'
  )
  STORAGE (MAXSIZE 32G)
  DEFAULT TABLESPACE sales_ts
    DATAFILE '/opt/oracle/oradata/CDB1/salespdb/sales_ts01.dbf'
    SIZE 1G AUTOEXTEND ON NEXT 256M MAXSIZE 16G
  PATH_PREFIX = '/opt/oracle/oradata/CDB1/salespdb/';

Key parameters:

ADMIN USER — creates a local user with PDB_DBA role.
FILE_NAME_CONVERT — maps seed datafiles to the new PDB location. Omitting this is the #1 cause of ORA-00600 during PDB creation.
PATH_PREFIX — restricts file system access for the PDB (strongly recommended for security).
STORAGE (MAXSIZE) — enforces PDB storage quota.

1.2 Open the PDB

ALTER PLUGGABLE DATABASE salespdb OPEN;

Verify:

SELECT pdb_name, open_mode FROM dba_pdbs WHERE pdb_name = 'SALESPDB';

1.3 Set the PDB to Auto-Open (Optional)

ALTER PLUGGABLE DATABASE salespdb SAVE STATE;

This ensures the PDB opens automatically when the CDB restarts.

1.4 Manage Common vs. Local Users

-- Create a common user (prefix C## required)
CREATE USER c##dba_admin IDENTIFIED BY "Str0ng!Pass" CONTAINER = ALL;
GRANT CREATE SESSION, SELECT ANY DICTIONARY TO c##dba_admin CONTAINER = ALL;

-- Create a local user inside the PDB
ALTER SESSION SET CONTAINER = salespdb;
CREATE USER app_user IDENTIFIED BY "App!Pass123" CONTAINER = CURRENT;
GRANT CONNECT, RESOURCE TO app_user;

Best practice: Use common users for administrative tasks across the CDB; use local users for application access within a single PDB.

Step 2: Cloning Operations

Cloning is the backbone of DevOps and test/dev workflows. Oracle 23ai supports four primary clone methods.

2.1 Local Clone (Same CDB)

-- Source PDB can remain OPEN READ WRITE
CREATE PLUGGABLE DATABASE salespdb_dev
  FROM salespdb
  FILE_NAME_CONVERT = (
    '/opt/oracle/oradata/CDB1/salespdb',
    '/opt/oracle/oradata/CDB1/salespdb_dev'
  );

Use case: Rapid test/dev copies within the same CDB. No downtime required.

2.2 Remote Clone (Across CDBs)

-- On the source CDB: create a database link
CREATE DATABASE LINK src_link
  CONNECT TO system IDENTIFIED BY "S3cure!Pass"
  USING 'source_cdb_tns';

-- On the target CDB: clone from the remote PDB
CREATE PLUGGABLE DATABASE salespdb_prod
  FROM salespdb@src_link
  FILE_NAME_CONVERT = (
    '/opt/oracle/oradata/SRCCDB/salespdb',
    '/opt/oracle/oradata/TGTCDB/salespdb_prod'
  );

Prerequisites:

Source and target CDBs must have compatible COMPATIBLE settings.
The database link user must have CREATE PLUGGABLE DATABASE privilege.
Source PDB must be OPEN READ WRITE (or READ ONLY for a consistent snapshot).

2.3 Snapshot Clone (Storage-Efficient)

-- Requires snapshot mode enabled on the source PDB
ALTER PLUGGABLE DATABASE salespdb SNAPSHOT MODE EVERY 24 HOURS;

-- Create a snapshot clone
CREATE PLUGGABLE DATABASE salespdb_snap
  FROM salespdb
  SNAPSHOT COPY;

Key points:

Snapshot clones use copy-on-write storage, consuming minimal space initially.
The source PDB must be in SNAPSHOT MODE (requires ALTER PLUGGABLE DATABASE ... SNAPSHOT MODE).
Snapshot clones are not independent — they depend on the source PDB’s storage. Do not drop the source without migrating the clone.

2.4 Refreshable Clone (Reporting / Offload)

-- Create a refreshable clone from a remote PDB
CREATE PLUGGABLE DATABASE salespdb_report
  FROM salespdb@src_link
  REFRESH MODE EVERY 30 MINUTES
  FILE_NAME_CONVERT = (
    '/opt/oracle/oradata/SRCCDB/salespdb',
    '/opt/oracle/oradata/TGTCDB/salespdb_report'
  );

Refresh manually:

ALTER PLUGGABLE DATABASE salespdb_report REFRESH;

Use case: Near-real-time reporting offload, ETL staging, or disaster recovery testing.

2.5 Unplug / Plug (Migration & Upgrade)

Unplug:

-- Close the PDB
ALTER PLUGGABLE DATABASE salespdb CLOSE;

-- Unplug and generate the XML descriptor
ALTER PLUGGABLE DATABASE salespdb UNPLUG INTO '/backup/salespdb.xml';

-- Drop the PDB but keep the datafiles
DROP PLUGGABLE DATABASE salespdb KEEP DATAFILES;

Plug into a new CDB:

-- Pre-check compatibility (see Diagnostic Checklist #2.6)
SET SERVEROUTPUT ON
DECLARE
  compatible BOOLEAN;
BEGIN
  compatible := DBMS_PDB.CHECK_PLUG_COMPATIBILITY(
    pdb_descr_file => '/backup/salespdb.xml',
    pdb_name       => 'SALESPDB'
  );
  IF compatible THEN
    DBMS_OUTPUT.PUT_LINE('Compatible');
  ELSE
    DBMS_OUTPUT.PUT_LINE('NOT Compatible');
  END IF;
END;
/

-- Plug the PDB using the XML descriptor
CREATE PLUGGABLE DATABASE salespdb
  USING '/backup/salespdb.xml'
  NOCOPY;

-- Open the PDB
ALTER PLUGGABLE DATABASE salespdb OPEN;

Critical notes:

NOCOPY tells Oracle to use the existing datafiles in place. Use COPY or MOVE if you need to relocate them.
If DBMS_PDB.CHECK_PLUG_COMPATIBILITY reports violations, query pdb_plug_in_violations and resolve each one before proceeding.
ORA-00600 during plug is almost always caused by a version mismatch between the source CDB’s COMPATIBLE and the target CDB. Verify both are identical.

2.6 Clone Method Comparison

Method	Source State	Downtime	Storage	Best For
Local Clone	OPEN READ WRITE	None	Full copy	Test/dev in same CDB
Remote Clone	OPEN READ WRITE	None	Full copy	Cross-CDB provisioning
Snapshot Clone	SNAPSHOT MODE	None	Copy-on-write	Storage-efficient dev/test
Refreshable Clone	OPEN READ WRITE	None	Full copy	Reporting, offload
Unplug/Plug	CLOSED	Required	Existing files	Migration, upgrade

Step 3: Lockdown Profiles

Lockdown profiles are the primary security control for PDBs. They restrict which features, options, statements, and file system paths are available inside a PDB. In 23ai, lockdown profiles are mandatory for production-grade deployments.

3.1 Create a Lockdown Profile

-- Create the profile (at CDB level)
CREATE LOCKDOWN PROFILE app_secure;

3.2 Disable Dangerous Features

-- Disable XDB protocols (mitigates known XDB protocol handler vulnerabilities)
ALTER LOCKDOWN PROFILE app_secure DISABLE FEATURE = ('XDB_PROTOCOLS');
#### 3.3 Restrict Features & Statements

```sql
-- Block ALTER SYSTEM and ALTER DATABASE statements inside PDB
ALTER LOCKDOWN PROFILE app_secure DISABLE STATEMENT = ('ALTER SYSTEM', 'ALTER DATABASE', 'DROP TABLESPACE');

-- Block CREATE DATABASE LINK to prevent data exfiltration
ALTER LOCKDOWN PROFILE app_secure DISABLE STATEMENT = ('CREATE DATABASE LINK');

3.4 Restrict Features

-- Disable XDB protocols and NETWORK_ACCESS
ALTER LOCKDOWN PROFILE app_secure DISABLE FEATURE = ('XDB_PROTOCOLS', 'NETWORK_ACCESS');

3.5 Restrict File System Paths

-- Restrict UTL_FILE access to a specific directory
ALTER LOCKDOWN PROFILE app_secure ENABLE PATH = ('/u01/app/oracle/admin/salespdb/*');
ALTER LOCKDOWN PROFILE app_secure DISABLE PATH = ('/etc/*', '/tmp/*', '/var/*');

3.6 Apply the Lockdown Profile to a PDB

-- Connect inside the PDB and set the PDB_LOCKDOWN parameter
ALTER SESSION SET CONTAINER = salespdb;
ALTER SYSTEM SET PDB_LOCKDOWN = app_secure SCOPE = BOTH;

3.7 Remove a Lockdown Profile

-- Unset profile inside PDB
ALTER SESSION SET CONTAINER = salespdb;
ALTER SYSTEM SET PDB_LOCKDOWN = '' SCOPE = BOTH;

-- Remove the profile entirely from CDB$ROOT
ALTER SESSION SET CONTAINER = CDB$ROOT;
DROP LOCKDOWN PROFILE app_secure;

3.8 Verify Lockdown Profile Enforcement

-- Confirm assignment parameter inside PDB
SELECT name, value FROM v$parameter WHERE name = 'pdb_lockdown';

-- Test: this should fail if the profile is enforced
ALTER SYSTEM SET optimizer_mode = 'ALL_ROWS';
-- Expected: ORA-01031: insufficient privileges

3.9 Lockdown Profile Rule Reference

Rule Type	Example	Scope	Use Case
`FEATURE`	`XDB_PROTOCOLS`	Entire feature disabled	Mitigate XDB protocol handler vulnerabilities
`STATEMENT`	`ALTER SYSTEM`	Specific SQL statement blocked	Block PDB configuration modification
`PATH`	`/etc/*`	File system access restricted	Prevent file system attacks

Step 4: Verification & Validation

After any clone, plug, or lockdown profile change, run this verification suite:

-- 1. Verify PDB state
SELECT pdb_name, open_mode, restricted
FROM dba_pdbs
WHERE pdb_name IN ('SALESPDB', 'SALESPDB_DEV', 'SALESPDB_SNAP');

-- 2. Verify no plug violations
SELECT type, message, status
FROM pdb_plug_in_violations
WHERE status = 'PENDING';

-- 3. Verify PDB operation history
SELECT op_timestamp, pdb_name, operation, cloned_from_pdb_name
FROM dba_pdb_history
ORDER BY op_timestamp DESC;

-- 4. Verify lockdown profile rule enforcement
SELECT rule_type, rule, clause, status
FROM v$lockdown_rules;

-- 5. Verify application connectivity
ALTER SESSION SET CONTAINER = salespdb;
CONNECT app_user/App!Pass123@salespdb;
SELECT 1 FROM dual;

Application-level validation:

Run a smoke test of critical application queries.
Verify connection pool health.
Confirm that blocked features (e.g., UTL_HTTP) fail gracefully in the application.

📚 Official Documentation & Technical References

Oracle Documentation

My Oracle Support

For verified MOS Knowledge Base notes and PDB cloning patch recommendations, consult My Oracle Support.

Oracle Database Reference — DBA_PDB_HISTORY View

Need Expert Help?

Multitenant architecture management, cloning strategy design, and lockdown profile implementation can make or break your Oracle environment. DBPros.Net’s enterprise DBA team has deep, hands-on experience with Oracle 23ai and 19c multitenant deployments across Fortune 500 environments.

Contact our experts for a free architecture review, or explore our services to see how we can help you design, secure, and optimize your Oracle Multitenant infrastructure.ptimize your Oracle Multitenant infrastructure.

This article is provided for informational purposes and is pending human verification. Always test procedures in a non-production environment before applying to production systems.

⚡ BLUF (Bottom Line Up Front) Summary

Environment & Prerequisites