Build Private AI Agents with Oracle OPAF: On-Prem, Secure and Low-Code

Introduction

Last year at Oracle AI World 2025, Oracle introduced a game-changing product called the Oracle Private Agent Factory (OPAF). It immediately stood out as one of the most exciting announcements of the event. For me, it really clarified Oracle’s direction; this isn’t just about adding AI features. Oracle is fundamentally rethinking how data and intelligence come together to deliver real value.

Oracle is the only database that can handle large workloads right now. So, for Oracle, data is just a matter of having the right tools to make AI work. The 26ai database has many features that enable AI. On top of that, having a private agent factory for data-driven business can do amazing things.

It’s also a no-code/low-code playground where both business users and engineers can quickly design, test, and deploy smart “Private Agents” that can safely work with company data. Instead of writing custom “glue code” to connect models to databases, the Agent Factory lets you “wire” these components together visually to build workflows that work and are aware of their context.

As I always say, some customers are still having trouble moving to the cloud. Companies that have sensitive data are hesitant to switch to the cloud. For this reason, AI tools should be used on-premises, so don’t assume that OPAF only works with OCI cloud. You can also get OPAF on your own premises.

For me, this is the time when we are moving toward systems that don’t need any code. OPAF is just what I needed to get started with AI. I’d like to bring up a few important points. A secure AI integration tool is important because many people are already familiar with Claude AI or ChatGPT. But when you want to get the value out of sensitive data, you need a secure tool like OPAF. I talked about MCP in a previous blog. OPAF provides an MCP you can use to connect to OCI Gen AI models powered by Oracle AI data centres.

Let’s take a more in-depth look at the features and abilities that I think make OPAF a big step forward for enterprise AI:

• The Template Gallery: The platform has a Template Gallery to help teams get started even faster. This is a carefully chosen set of pre-made agent flows and patterns that you can use as a starting point for your own projects. This way, you won’t have to start from scratch when building common AI use cases. I used this a lot to learn how to start making my own flows.
  
  

• Pre-built Agents: The platform comes with special, pre-built agents that can do certain data tasks right away:

  • Knowledge Agent: Use vector search to get grounded, traceable answers from approved sources, such as SharePoint or Object Storage, for RAG (Retrieval-Augmented Generation) over business documents.

  • Data Analysis Agent: This tool is great for structured data because it doesn’t just run SQL; it also analyzes your tables and views and makes visualizations and explanations in plain language.
    

  
  

• User Management: Security is built in with strong user management that works with Single Sign-On (SSO), like OAuth. This lets companies manage access from one place using their current corporate identity providers. This makes sure that only authorized users can create or interact with private agents while keeping the login process smooth.
  
  

• The No-Code Agent: Builder has a visual, drag-and-drop interface at its core. It takes care of the hard work for you, letting you connect chat inputs, LLMs, and data sources, including native integration with the Oracle Autonomous AI Database, using simple visual building blocks.
  
  

• Private AI Services Container: This is one of the best features if you care about data privacy and control. With OPAF, you can run LLMs in your own space with tools like Ollama or vLLM, which keep your data within your network. You don’t have to send sensitive information to outside AI providers, which gives you more control and peace of mind.

In this article, I’ll walk you through how to install OPAF on an Oracle Linux 8 (OEL8) virtual machine.

Manual Installation on Linux

For this example, I will use Oracle Linux 8, as it is currently the only supported version for this setup. I am following the official Oracle documentation for installing Oracle Private Agent Factory (OPAF): Oracle OPAF Installation Prerequisites.

Currently supported operating systems:

• MAC OS Intel

• Oracle Linux 8 on AMDx86_64

• Oracle Linux 8 on ARM64

• MAC OS ARM64 (M.x chipsets)

You need to download the software using OPAF Download.

Installation Modes

There are two types of installation modes:

• Production

• Quick Start

Note: Ensure you have at least 100 GB of space in the /tmp directory, as the installation files are extracted there.

For this example, I will proceed with the Quick Start installation.

Prerequisites

Before you begin, make sure you have the following in place:

• A non-root user (for this example, installation is done using the oracle user)

• Internet access from the VM

• Oracle Linux 8 (OEL8) as the operating system

• Sudo privileges for the user performing the installation

• An Oracle Container Registry authentication token

Run the Installer

Once the files are extracted, run the installer using:

./interactive_install.sh

Important:

During the installation, you’ll be prompted to choose the environment type. For an on-premises setup, select option 1.

Enter 1 if you are on a Standard Oracle Linux machine or 2 if you are on OCI [1]:

Sample installation

Installation Failure

Installation Failure #1: Missing Sudo Privileges

Before starting the installation, make sure the oracle user is added to the /etc/sudoers file. If not configured, the installation will fail with errors similar to the ones shown below.

Solution

Add the following entry in the sudoers file:

Installation Failure #2: Missing Podman Temporary Directory

Another common error occurs due to a missing directory: : /scratch/podman_tmp/podman-run-54321/libpod/tmp/

Solution

Manually create the required directory structure and assign proper ownership:

Oracle Container Registry

The Oracle Container Registry (OCR) is a public repository where anyone can find Docker containers to run their products. You need an Oracle account to log in, and with the move to SSO, you now need an Auth Token, which means you can’t do three-legged authentication. The OPAF deployment process that we are about to start is one example. Sign in to the OCR with your Oracle account if you haven’t already. Then do these things:

1. Click your username on the top-right of the website to expose the options, and select the option Auth Token.

2. Click the Generate Secret Key button.

3. After the auth token has been created, click the Copy Secret Key link.

If you have not already done so, follow the above instructions to create an auth token to log in to the OCR. Provide your Oracle account email/username and auth token.

The installer script will download the container images from the OCR, then ask if a manual database setup is required. Hit Enter to accept the default value N.

Enter 2 to deploy OPAF in the quickstart mode.

The full log is generated as part of the container build process, during which all required RPM packages are downloaded.

Container Build Log: Sharing this to provide a clear understanding of how the process works. Repetitive entries (e.g., “Copying blob … done”) have been removed to reduce log length.

Successful Installation

Once the deployment is successful, take note of the web application’s URL displayed in the output.

Once you execute podman ps, two running containers should be displayed.

Configure OPAF

During the initial setup, you’ll see the first login screen where you need to create your administrative credentials. This step is required to access and manage the OPAF environment after installation.

Make sure to securely store the username and password you create here, as they will be used for all future logins.

Click the Install button to install the OPAF components.

If the installation is successful, the button Next will be enabled. Click it to proceed to the LLM configuration step.

For LLM configuration, you need to create a user in OCI and subscribe to a region where generative AI services are available.

The Generative AI service endpoint can be found in the Oracle Cloud Infrastructure API Reference under Generative AI Service Inference endpoints: Generative AI Service Inference API | Oracle Cloud Infrastructure API Reference and Endpoints

Currently available generative AI endpoints:

Add the key:

Test the connection and save the configuration. Do the same thing for the embedding model as well. Otherwise, you can skip the embedding model; it will take local.

Validate the Installation

In the next article, I will elaborate on how you can play with OPAF products.

Conclusion

AI is no longer a buzzword, as we can see from Oracle AI World 2025. Oracle has shown they are serious about this by building two AI data centres. The launch of Oracle Private Agent Factory (OPAF) was also a strong sign of where enterprise AI is going, not just another product launch.

Organizations have been asking for OPAF’s features: the ability to work with AI safely, keep data in their own environment, and make it easier to build smart solutions. It gets rid of a lot of the usual problems that stop people from using AI by combining Oracle’s data platform with a low-code approach.

Flexibility is what stands out the most. OPAF lets you choose how and where your AI runs, whether it’s in the cloud or on-premises. This is not just helpful for businesses that handle sensitive data; it is necessary.

At the same time, the move toward low-code/no-code development is getting more real than ever. OPAF lets both technical and non-technical users work together, try new things, and deliver value faster without having to deal with complicated integrations.

OPAF is more than just a tool; it’s a step toward making AI useful, safe, and available for businesses to use in the real world. Contact us today to find out more.