Setting Up Oracle Private AI Agent Factory (PAF) 26.4 on OCI — A Step-by-Step Walkthrough

Oracle's self-hosted platform for building, running, and governing AI agents against your own data, entirely inside your network perimeter. Unlike a SaaS agent platform, PAF runs as a set of containers on a VM you control, which makes it a great fit for enterprises that want agentic AI capabilities without their data ever leaving the tenancy.

Prerequisites

Before you start, make sure you have:

- An OCI compute instance running **Oracle Linux 9** (this walkthrough uses OL9), sized appropriately for PAF (the installer and container build need real CPU/RAM/disk headroom).

- SSH key-based access to the VM as the `opc` user.

- A block volume attached to the instance with at least 60 GB free (PAF's storage requirement) — I used a 150 GB volume to leave room to grow.

- An Oracle 26ai Database (or Autonomous Database) you can connect PAF to, with SYSDBA access to create schema users.

- Credentials for the Oracle Container Registry (container-registry.oracle.com) — the installer will ask you to log in during setup.

- The PAF installer archive for your target version (in my case, `oracle_agent_factory_X64_26.4.0.tar.gz`, roughly 2.3 GB).

Stage and Extract the PAF Installer

Back on my laptop, I copied the installer archive to the VM:

```bash

scp -i ssh-key-*.key oracle_agent_factory_X64_26.4.0.tar.gz opc@<your-vm-public-ip>:/home/opc

```

Then, as root, I moved it into a staging directory under `/u01` and handed ownership to the service account:

mkdir /u01/staging264   # as cbtpafadm

[root@vmcbtpaf staging264]# mv /home/opc/oracle_agent_factory_X64_26.4.0.tar.gz /u01/staging264/

[root@vmcbtpaf staging264]# chown cbtpafadm:cbtpafadm /u01/staging264/oracle_agent_factory_X64_26.4.0.tar.gz

[cbtpafadm@vmcbtpaf u01]$ cd /u01/staging264

[cbtpafadm@vmcbtpaf staging264]$ tar xzf oracle_agent_factory_X64_26.4.0.tar.gz

This unpacks a full toolkit — `interactive_install.sh`, `deploy.sh`, `build-image.sh`, `upgrade.sh`, `Makefile`, Podman Compose files for quickstart/prod/upgrade, and supporting scripts.

## Run the Interactive Installer

Before launching the installer, since this was a fresh non-interactive shell session, I had to manually set up the systemd user bus for the service account:

export XDG_RUNTIME_DIR=/run/user/$(id -u)

systemctl --user status

Once that showed `State: running`, I kicked off the installer:

./interactive_install.sh

The installer walks through a series of guided steps, and it's genuinely well designed — it re-detects completed steps on reruns, so you can safely restart it if something goes wrong partway through. Here's what it asked, in order:

1. Proxy configuration — I answered "N" since my OCI network doesn't require an HTTP/HTTPS proxy.

2. Platform type — Selected **OCI Oracle Linux VM** (option 2) rather than a generic on-prem Oracle Linux box.

3. Linux username — Confirmed `cbtpafadm` as the service account.

4. Install Podman and configure SELinux — The installer installed `podman` and its dependencies via `dnf`, and set SELinux to permissive mode for the session.

5. Configure Podman storage — I pointed it at `/u01`, the mount I'd prepared with 60+ GB free.

6. Log in to the Oracle Container Registry — using my Oracle SSO credentials at container-registry.oracle.com.

7. Install podman-compose — pulled in Python 3.12 and installed `podman-compose` via `pip` for the current user.

8. Enable user linger — already done in Step 3, so the installer skipped straight past it.

9. Configure firewall — opened port 8080 for the Agent Factory web UI.

## Manual Database Setup

PAF needs a runtime schema user and a matching read-only user on your Oracle 23ai database. The installer prints out the exact SQL to run — you paste this into a SQLcl/SQL*Plus session against your PDB as SYSDBA:

```sql

CREATE USER pafdbadm IDENTIFIED BY "<your_db_password>"

  DEFAULT TABLESPACE USERS QUOTA UNLIMITED ON USERS;

GRANT CREATE SESSION, CREATE TABLE, CREATE SEQUENCE, CREATE TRIGGER,

      CREATE TYPE, CREATE PROCEDURE, CREATE VIEW, CREATE SYNONYM

  TO pafdbadm;

GRANT READ, WRITE ON DIRECTORY DATA_PUMP_DIR TO pafdbadm;

GRANT SELECT ON V_$PARAMETER TO pafdbadm;

CREATE USER AAI_RO_pafdbadm IDENTIFIED BY "<same_db_password>" ACCOUNT UNLOCK;

GRANT CREATE SESSION TO AAI_RO_pafdbadm;

```

==>NOTE: The read-only username must follow the exact pattern `AAI_RO_<your_runtime_username>`, and its password must match the runtime user's password. This isn't a convention you can deviate from — PAF derives the read-only account name programmatically from the runtime username.

The installer also checks whether your database has Extended VARCHAR2 enabled (`max_string_size = EXTENDED`), which PAF relies on for some of its larger text columns:

```sql

SELECT value FROM v$parameter WHERE name = 'max_string_size';

```

If it isn't already `EXTENDED`, the fix requires a database restart:

```sql

ALTER SYSTEM SET max_string_size=extended SCOPE=SPFILE;

SHUTDOWN NORMAL;

STARTUP UPGRADE;

@$ORACLE_HOME/rdbms/admin/utl32k.sql

SHUTDOWN IMMEDIATE;

STARTUP;

@$ORACLE_HOME/rdbms/admin/utlrp.sql

```

WARN => This is a database-wide setting change with a restart — plan it during a maintenance window if you're pointing PAF at a shared or production database, not a dedicated sandbox instance.

##  Set Up the Start/Stop systemd Service

Back in the installer, I opted to let it create a **Linux user service** so the PAF containers start and stop cleanly on VM reboot:

```

Create Linux user service for start/stop on VM reboot? (y/N): y

## Build the Container Images

This is the longest step by far — building the PAF application image from scratch:

```bash

# from within interactive_install.sh, or standalone:

bash build-image.sh

```

You'll be asked to choose a mode:

```

1) prod

2) quickstart

Enter choice (1 or 2): 1

```

I went with Production mode, which builds against Oracle Linux 8 as the base image and layers on the JDK, Oracle Instant Client, and roughly 100+ supporting RPM packages (fonts, GTK libraries for headless rendering, build tools, etc.). Expect this to pull several hundred MB and take a good few minutes even on a fast connection — the image lands at around 6.3 GB.

Once complete, you'll see a summary table confirming the build:

```

| Image             | Status  | Size   | Image ID          | Tags                                  |

| applied-ai-label  | SUCCESS | 6.3 GB | 00571dc4aa3d498... | localhost/applied-ai-label:26.4.0.0.0 |

```

This creates and enables a `systemd --user` unit (`agentfactory_startstop.service`) that's symlinked into the default target, so it activates automatically once the service account's session (or linger) is active.

##  Launch the Application Containers

With the image built, the installer moves on to `make install`, which runs `deploy.sh`:

```bash

bash deploy.sh

```

Deploy asks how you want the web UI exposed:

```

1) Private to this host: the web UI is reachable only from this machine.

2) Reachable from other hosts: the web UI listens on all host interfaces,

   subject to network and firewall rules.

Selection: 2

```

I chose option 2 (reachable from other hosts)** since I wanted to access the UI from my laptop rather than only via a local port-forward — but this is exactly where your OCI **security list / NSG rules** matter. Opening port 8080 in the OS firewall (Step 5) isn't enough on its own; you also need an ingress rule on the subnet or NSG allowing traffic on 8080 from your source IP range.

`deploy.sh` then runs through several stages — starting the container, running database migration, storing the app secret key, and configuring the version link:

```

| Stage                                           | Status     |

| Stopping Oracle Private AI Agent agent_factory  | Successful |

| Storing App Secret Key                          | Successful |

| Database Migration                              | Successful |

| Starting Oracle Private AI Agent agent_factory  | Successful |

| Configured Version Link                         | Successful |

```

Once complete, you get the URL for the web UI:

```

https://<your-vm-hostname>.<your-subnet-domain>.oraclevcn.com:8080/agentFactory/

```

## First Login to the Agent Factory Web UI

Navigating to that URL brings up the Agent Factory login page. From here you can log in and start exploring the console — connecting data sources, configuring agents, and setting up your first pipelines.

```ini

[DEFAULT]

user=<your-user-ocid>

fingerprint=<your-api-key-fingerprint>

tenancy=<your-tenancy-ocid>

region=<your-region>

key_file=<path-to-your-private-api-key>

```

Thanks & Regards,

Chandan Tanwani

How to Fix ORA-14694: Database Must Be in UPGRADE Mode for MAX_STRING_SIZE Migration

Have you ever tried to scale up your Oracle database strings from the classic 4,000-byte limit to the glorious 32,767 bytes (EXTENDED), only to be slapped with a frustrating error during startup?

If you are seeing this,

ALTER PLUGGABLE DATABASE freepdb1 open;

* ERROR at line 1:

ORA-14694: database must in UPGRADE mode to begin MAX_STRING_SIZE migration

Don't panic. This happens because your Container Database (CDB) already transitioned its MAX_STRING_SIZE parameter to EXTENDED, but your Pluggable Database (freepdb1) hasn't finished the migration script yet. 

It is stuck in limbo. Fixing this is a quick 5-step process. Let's walk through it.

Step 1: Force the PDB into Upgrade Mode Because the database requires data type dictionary conversions, it refuses to open normally. We need to explicitly tell Oracle to open the PDB in UPGRADE mode. Log into your CDB as SYSDBA and run:

SQL> ALTER PLUGGABLE DATABASE freepdb1 OPEN UPGRADE;

Step 2: Switch Over to Your PDBNext, jump into the context of the pluggable database where the error occurred:

SQL> ALTER SESSION SET CONTAINER = freepdb1;

 

Step 3: Run the utl32k.sql Migration Script. This is where the magic happens. Oracle provides a built-in script that automatically converts your metadata and tables to support the extended string sizes. Run it directly from your SQL prompt:

SQL> @?/rdbms/admin/utl32k.sql

 

(The ? is just a built-in shortcut for your $ORACLE_HOME path).

Step 4: Restart the PDB Normally. Once the script successfully completes, your data structures are upgraded. Now, bounce the PDB to take it out of upgrade mode and open it for standard business use

SQL> ALTER PLUGGABLE DATABASE freepdb1 CLOSE;

SQL> ALTER PLUGGABLE DATABASE freepdb1 OPEN READ WRITE;

 

Step 5: Double-Check Your Work. Always verify! Run this quick check inside the PDB to confirm that your maximum string size is now officially extended

SQL> SHOW PARAMETER max_string_size;

NAME              TYPE        VALUE

----------------- ----------- ---------

max_string_size   string      EXTENDED

The ORA-14694 error looks intimidating, but it is just Oracle’s safety mechanism preventing data corruption before a major structural change. Follow these steps, and you will be handling 32K strings in no time.

Did you run into any invalid objects or compilation glitches while running utl32k.sql? Drop a comment below and let's troubleshoot!

Thanks & Regards,

Chandan Tanwani

AIOUG Sangam AI Yatra 2026: A Two-City Journey of AI, Databases, and Community

This July, AIOUG (All India Oracle Users Group) took its flagship event on the road again — a two-city tour across India, landing in Bengaluru on July 18 and Hyderabad on July 19. I had the privilege of speaking at both stops.

The Session: The Self-Driving Database

At both Bengaluru and Hyderabad, I presented "The Self-Driving Database: Powering AI Agents with an MCP Server Backend."

The core idea I wanted to leave people with: everyone's racing to build smarter AI agents, but very few are talking about the harder problem — giving those agents *safe*, structured access to enterprise data. That's exactly where the Model Context Protocol (MCP) comes in.

In the session, I walked through:

- How MCP acts as a universal interface between AI agents and enterprise databases

- How agents can query databases safely using natural language instead of hand-written SQL

- Design patterns for schema-aware query generation, validation, and summarization

- A production-ready reference architecture for autonomous MCP database servers

- Practical guidance for actually deploying MCP-enabled AI applications in the enterprise, not just demoing them

Delivering the same talk twice, a day apart, in two different cities, is its own kind of interesting. Bengaluru's crowd leaned deep into architecture questions — connection security, transport protocols, the stdio-vs-HTTP/SSE nuances. Hyderabad pushed harder on the "how do I sell this internally" side — governance, adoption, and where MCP fits against existing integration patterns. Same slides, two very different conversations. That's the real value of doing both stops instead of just one.

Bigger Than Any Single Track

Sangam AI Yatra 2026 wasn't just my session — it was 30+ industry experts and global speakers from Oracle, Microsoft, and Google, alongside Oracle ACEs, Microsoft MVPs, cloud architects, and AI practitioners, all covering AI & Generative AI, Oracle Database & Cloud, multi-cloud platforms, data & analytics, and real customer success stories. Whether you were a developer, DBA, architect, student, or technology leader, there was a track worth your time.

Just imagine the amount of knowledge, experience, and practical insights that came together under one roof! I’m sharing this speaker list because it represents much more than a list of names—it reflects the incredible community and collective expertise that made SANGAM AI Yatra special.

"Sai Penumuru, Sandesh Rao, Connor McDonald, Basheer Khan, Mike Dietrich, Kamil Stawiarski, Prabhaker Gongloor, Vijayganesh Sivaprakasam, Gavin Soorma, Ambili Thottathil, Biju Thomas, Paramdeep Saini, Markus Michalewicz, Andy Colvin, Kalyan Ram Kaki, Alex Masharov, Rakesh Mittal, Michael Coleman, Vivek Sharma, Abhinav Agarwal, Angeline Janet Dhanarani, Chandan Tanwani, Suraj Malli Ramesh, Deeksha Sehgal, Arpit Agrawal, Karan Dodwal, Harin Vadodaria, Narasimharao Karanam, Aishwarya Kala, Anuj Gulati, Lalitha Venkataraman, Makarand Pandey, Chaithra M G,  Leona Chauhan"

Each speaker brought a unique perspective, deep technical expertise, and valuable real-world experience across Oracle Database, AI, Cloud, Applications, and emerging technologies.

The ACE Dinner: Where the Real Magic Happens

If the sessions were the reason I came, the **ACE Dinner** is the reason I'll keep coming back.

There's something genuinely special about seeing Oracle ACEs from across India — Bengaluru, Hyderabad, Chennai, Mumbai, Pune, and beyond — all under one roof, out of speaker mode, just being a community. No slides, no clocks to watch, no Q&A time limits.

The evening had a fun activity that got everyone (even the quieter folks) laughing and competing, followed by dinner where the conversations wandered everywhere — from database internals to travel stories to who's speaking where next. It's rare to get that many people who've spent decades in the Oracle ecosystem, at very different career stages and specializations, in one informal room. You leave with more than contacts — you leave with genuine connections.

Many thanks to AIOUG for giving this opportunity to be a part of AIOUG and SANGAM AI Yatra.

Thanks & Regards,

Chandan Tanwani