There is no config file. Run `oci setup config` and answer the prompts (it generates the key pair and writes `~/.oci/config`), or set `OCI_CLI_CONFIG_FILE` to the file's real location. The CLI cannot authenticate with nothing to read.

```text
$ oci iam user list
ConfigFileNotFound: Could not find config file at ~/.oci/config
```

## Fix

1. Generate the config:
   ```bash
   oci setup config
   ```
   Answer the prompts (user OCID, tenancy OCID, region, generate a new key pair). Expected: `Private key written to: ~/.oci/oci_api_key.pem` and `Config written to: ~/.oci/config`.

2. Upload the generated public key to the console (Identity, Users, your user, API Keys, Add API Key, paste `~/.oci/oci_api_key_public.pem`).
   Expected: the fingerprint shown matches the config's fingerprint.

3. If the file lives elsewhere, point the CLI at it:
   ```bash
   export OCI_CLI_CONFIG_FILE=/path/to/config
   ```

4. Verify:
   ```bash
   oci iam user list
   ```
   Expected: user details print.

## When this applies
- `ConfigFileNotFound` on new machines, containers, CI runners.
- The `~/.oci/` directory does not exist.

## When it does NOT apply
- `ProfileNotFound`: the file exists, the named profile does not.
- 401 with an existing config: key/fingerprint problem.
- Session-auth expiry: the session token died, not the config.

## Compatibility
- oci-cli 3.x.

## Why it happens
The CLI's default config path is hardcoded to `~/.oci/config`. Anything that changes HOME (sudo, containers, service users, CI) moves the lookup, and a fresh machine simply never had setup run. The error fires before any network call.

## Edge cases
- `oci setup config` overwrites `~/.oci/config` if it exists; back it up first on machines with working profiles.
- The config file holds no secrets itself, but `oci_api_key.pem` next to it does; keep both 0600.
- In CI, prefer instance principals over copying config files and private keys around.