Setting Up Oracle Private AI Agent Factory (PAF) 26.4 on OCI — A Step-by-Step Walkthrough

Oracle's self-hosted platform for building, running, and governing AI agents against your own data, entirely inside your network perimeter. Unlike a SaaS agent platform, PAF runs as a set of containers on a VM you control, which makes it a great fit for enterprises that want agentic AI capabilities without their data ever leaving the tenancy.

Prerequisites

Before you start, make sure you have:

- An OCI compute instance running **Oracle Linux 9** (this walkthrough uses OL9), sized appropriately for PAF (the installer and container build need real CPU/RAM/disk headroom).

- SSH key-based access to the VM as the `opc` user.

- A block volume attached to the instance with at least 60 GB free (PAF's storage requirement) — I used a 150 GB volume to leave room to grow.

- An Oracle 26ai Database (or Autonomous Database) you can connect PAF to, with SYSDBA access to create schema users.

- Credentials for the Oracle Container Registry (container-registry.oracle.com) — the installer will ask you to log in during setup.

- The PAF installer archive for your target version (in my case, `oracle_agent_factory_X64_26.4.0.tar.gz`, roughly 2.3 GB).

Stage and Extract the PAF Installer

Back on my laptop, I copied the installer archive to the VM:

```bash

scp -i ssh-key-*.key oracle_agent_factory_X64_26.4.0.tar.gz opc@<your-vm-public-ip>:/home/opc

```

Then, as root, I moved it into a staging directory under `/u01` and handed ownership to the service account:

mkdir /u01/staging264 # as cbtpafadm

[root@vmcbtpaf staging264]# mv /home/opc/oracle_agent_factory_X64_26.4.0.tar.gz /u01/staging264/

[root@vmcbtpaf staging264]# chown cbtpafadm:cbtpafadm /u01/staging264/oracle_agent_factory_X64_26.4.0.tar.gz

[cbtpafadm@vmcbtpaf u01]$ cd /u01/staging264

[cbtpafadm@vmcbtpaf staging264]$ tar xzf oracle_agent_factory_X64_26.4.0.tar.gz

This unpacks a full toolkit — `interactive_install.sh`, `deploy.sh`, `build-image.sh`, `upgrade.sh`, `Makefile`, Podman Compose files for quickstart/prod/upgrade, and supporting scripts.

## Run the Interactive Installer

Before launching the installer, since this was a fresh non-interactive shell session, I had to manually set up the systemd user bus for the service account:

export XDG_RUNTIME_DIR=/run/user/$(id -u)

systemctl --user status

Once that showed `State: running`, I kicked off the installer:

./interactive_install.sh

The installer walks through a series of guided steps, and it's genuinely well designed — it re-detects completed steps on reruns, so you can safely restart it if something goes wrong partway through. Here's what it asked, in order:

1. Proxy configuration — I answered "N" since my OCI network doesn't require an HTTP/HTTPS proxy.

2. Platform type — Selected **OCI Oracle Linux VM** (option 2) rather than a generic on-prem Oracle Linux box.

3. Linux username — Confirmed `cbtpafadm` as the service account.

4. Install Podman and configure SELinux — The installer installed `podman` and its dependencies via `dnf`, and set SELinux to permissive mode for the session.

5. Configure Podman storage — I pointed it at `/u01`, the mount I'd prepared with 60+ GB free.

6. Log in to the Oracle Container Registry — using my Oracle SSO credentials at container-registry.oracle.com.

7. Install podman-compose — pulled in Python 3.12 and installed `podman-compose` via `pip` for the current user.

8. Enable user linger — already done in Step 3, so the installer skipped straight past it.

9. Configure firewall — opened port 8080 for the Agent Factory web UI.

## Manual Database Setup

PAF needs a runtime schema user and a matching read-only user on your Oracle 23ai database. The installer prints out the exact SQL to run — you paste this into a SQLcl/SQL*Plus session against your PDB as SYSDBA:

```sql

CREATE USER pafdbadm IDENTIFIED BY "<your_db_password>"

DEFAULT TABLESPACE USERS QUOTA UNLIMITED ON USERS;

GRANT CREATE SESSION, CREATE TABLE, CREATE SEQUENCE, CREATE TRIGGER,

CREATE TYPE, CREATE PROCEDURE, CREATE VIEW, CREATE SYNONYM

TO pafdbadm;

GRANT READ, WRITE ON DIRECTORY DATA_PUMP_DIR TO pafdbadm;

GRANT SELECT ON V_$PARAMETER TO pafdbadm;

CREATE USER AAI_RO_pafdbadm IDENTIFIED BY "<same_db_password>" ACCOUNT UNLOCK;

GRANT CREATE SESSION TO AAI_RO_pafdbadm;

```

==>NOTE: The read-only username must follow the exact pattern `AAI_RO_<your_runtime_username>`, and its password must match the runtime user's password. This isn't a convention you can deviate from — PAF derives the read-only account name programmatically from the runtime username.

The installer also checks whether your database has Extended VARCHAR2 enabled (`max_string_size = EXTENDED`), which PAF relies on for some of its larger text columns:

```sql

SELECT value FROM v$parameter WHERE name = 'max_string_size';

```

If it isn't already `EXTENDED`, the fix requires a database restart:

```sql

ALTER SYSTEM SET max_string_size=extended SCOPE=SPFILE;

SHUTDOWN NORMAL;

STARTUP UPGRADE;

@$ORACLE_HOME/rdbms/admin/utl32k.sql

SHUTDOWN IMMEDIATE;

STARTUP;

@$ORACLE_HOME/rdbms/admin/utlrp.sql

```

WARN => This is a database-wide setting change with a restart — plan it during a maintenance window if you're pointing PAF at a shared or production database, not a dedicated sandbox instance.

## Set Up the Start/Stop systemd Service

Back in the installer, I opted to let it create a **Linux user service** so the PAF containers start and stop cleanly on VM reboot:

```

Create Linux user service for start/stop on VM reboot? (y/N): y

## Build the Container Images

This is the longest step by far — building the PAF application image from scratch:

```bash

# from within interactive_install.sh, or standalone:

bash build-image.sh

```

You'll be asked to choose a mode:

```

1) prod

2) quickstart

Enter choice (1 or 2): 1

```

I went with Production mode, which builds against Oracle Linux 8 as the base image and layers on the JDK, Oracle Instant Client, and roughly 100+ supporting RPM packages (fonts, GTK libraries for headless rendering, build tools, etc.). Expect this to pull several hundred MB and take a good few minutes even on a fast connection — the image lands at around 6.3 GB.

Once complete, you'll see a summary table confirming the build:

```

```

This creates and enables a `systemd --user` unit (`agentfactory_startstop.service`) that's symlinked into the default target, so it activates automatically once the service account's session (or linger) is active.

## Launch the Application Containers

With the image built, the installer moves on to `make install`, which runs `deploy.sh`:

```bash

bash deploy.sh

```

Deploy asks how you want the web UI exposed:

```

1) Private to this host: the web UI is reachable only from this machine.

2) Reachable from other hosts: the web UI listens on all host interfaces,

subject to network and firewall rules.

Selection: 2

```

I chose option 2 (reachable from other hosts)** since I wanted to access the UI from my laptop rather than only via a local port-forward — but this is exactly where your OCI **security list / NSG rules** matter. Opening port 8080 in the OS firewall (Step 5) isn't enough on its own; you also need an ingress rule on the subnet or NSG allowing traffic on 8080 from your source IP range.

`deploy.sh` then runs through several stages — starting the container, running database migration, storing the app secret key, and configuring the version link:

```

| Stage | Status |

| Stopping Oracle Private AI Agent agent_factory | Successful |

| Storing App Secret Key | Successful |

| Database Migration | Successful |

| Starting Oracle Private AI Agent agent_factory | Successful |

| Configured Version Link | Successful |

```

Once complete, you get the URL for the web UI:

```

https://<your-vm-hostname>.<your-subnet-domain>.oraclevcn.com:8080/agentFactory/

```

## First Login to the Agent Factory Web UI

Navigating to that URL brings up the Agent Factory login page. From here you can log in and start exploring the console — connecting data sources, configuring agents, and setting up your first pipelines.

```ini

[DEFAULT]

user=<your-user-ocid>

fingerprint=<your-api-key-fingerprint>

tenancy=<your-tenancy-ocid>

region=<your-region>

key_file=<path-to-your-private-api-key>

```

Thanks & Regards,

Chandan Tanwani

Lazy DBA

Monday, August 31, 2026

Setting Up Oracle Private AI Agent Factory (PAF) 26.4 on OCI — A Step-by-Step Walkthrough

Setting Up Oracle Private AI Agent Factory (PAF) 26.4 on OCI — A Step-by-Step Walkthrough

No comments: