Oracle AI Database 26ai + Cohere + SELECT AI | Complete Docker Setup Guide

SELECT AI is one of the most exciting features in Oracle AI Database 26ai, allowing you to interact with your database using natural language instead of writing SQL. Simply describe what you want in plain English, and Oracle leverages a Large Language Model (LLM) to generate and execute the appropriate SQL query. In this guide, we'll configure SELECT AI with **Cohere** on a fresh Oracle AI Database 26ai Free Docker installation, taking you from installation to a fully working AI-powered SQL experience.

Note: You might need Oracle 26ai database up and running in Docker. You should also have SQLcL present. Kindly look into my Youtube channel for more deeper insights :)

Step 1 – Install DBMS_CLOUD

Verify the Oracle Home inside the Docker container.

echo $ORACLE_HOME

Create the Cloud Service schema.

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/rdbms/admin/catcon.pl -u sys/YourPassword123 --force_pdb_mode "READ WRITE" -b catclouduser -d $ORACLE_HOME/rdbms/admin -l /tmp catclouduser.sql

Install DBMS_CLOUD.

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/rdbms/admin/catcon.pl -u sys/YourPassword123 --force_pdb_mode "READ WRITE" -b dbms_cloud_install -d $ORACLE_HOME/rdbms/admin -l /tmp dbms_cloud_install.sql

---

Step 2 – Verify Installation

SELECT owner, object_name, object_type, status FROM dba_objects WHERE object_name IN ('DBMS_CLOUD','DBMS_CLOUD_AI');

Expected Owner: C##CLOUD$SERVICE

---

Step 3 – Grant Required Privileges

Connect as SYS and execute:

GRANT EXECUTE ON DBMS_CLOUD TO AIUSER;

GRANT EXECUTE ON DBMS_CLOUD_AI TO AIUSER;

---

Step 4 – Create Cohere Credential

Connect as AIUSER and create the credential.

BEGIN DBMS_CLOUD.CREATE_CREDENTIAL(credential_name=>'COHERE_CRED',username=>'COHERE',password=>'<COHERE_API_KEY>'); END; /

Verify the credential.

SELECT credential_name FROM user_credentials;

---

Step 5 – Configure SSL Wallet

Oracle AI Database requires an SSL wallet containing trusted Certificate Authority (CA) certificates in order to securely communicate with external AI providers such as Cohere. Without these certificates, requests will fail with SSL-related errors such as ORA-28759 or ORA-20011.

Create a wallet directory.

mkdir -p /opt/oracle/admin/FREE/ssl_wallet

Create the SSL wallet.

$ORACLE_HOME/bin/orapki wallet create -wallet /opt/oracle/admin/FREE/ssl_wallet -pwd Welcome123# -auto_login

Next, create a temporary working directory for downloading the latest trusted CA certificates.

mkdir -p /tmp/cacerts

Navigate to the working directory.

cd /tmp/cacerts

Download the latest Mozilla CA bundle used by curl.

curl -L https://curl.se/ca/cacert.pem -o cacert.pem

Split the downloaded bundle into individual certificate files.

awk 'BEGIN {c=0} /BEGIN CERTIFICATE/ {c++} {print > ("cert" c ".pem")}' cacert.pem

Optionally verify that the certificates were extracted successfully. You should see well over 100 certificates.

ls cert*.pem | wc -l

Import all trusted certificates into the Oracle SSL wallet.

for f in cert*.pem; do echo "Importing $f"; $ORACLE_HOME/bin/orapki wallet add -wallet /opt/oracle/admin/FREE/ssl_wallet -trusted_cert -cert "$f" -pwd 'Welcome123#'; done

Note: The wallet password is enclosed in single quotes. This prevents the Linux shell from interpreting the # character as the beginning of a comment.

Verify that the wallet now contains multiple trusted certificates.

$ORACLE_HOME/bin/orapki wallet display -wallet /opt/oracle/admin/FREE/ssl_wallet

Finally, configure Oracle Database to use this wallet for outbound HTTPS requests. Ensure your session is connected to the Root Container (CDB$ROOT) before executing the following command.

ALTER DATABASE PROPERTY SET SSL_WALLET='/opt/oracle/admin/FREE/ssl_wallet';

Verify that the database property has been configured correctly.

SELECT property_name, property_value FROM database_properties WHERE property_name='SSL_WALLET';

---

Step 6 – Configure Network ACLs

Connect as SYS in CDB$ROOT

ALTER SESSION SET CONTAINER=CDB$ROOT;

Grant outbound HTTPS access to the internal Cloud Service schema.

BEGIN DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(host=>'api.cohere.ai',lower_port=>443,upper_port=>443,ace=>xs$ace_type(privilege_list=>xs$name_list('connect','http'),principal_name=>'C##CLOUD$SERVICE',principal_type=>xs_acl.ptype_db)); END; /

Switch to FREEPDB1

ALTER SESSION SET CONTAINER=FREEPDB1;

Grant outbound HTTPS access to AIUSER.

BEGIN DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE(host=>'api.cohere.ai',lower_port=>443,upper_port=>443,ace=>xs$ace_type(privilege_list=>xs$name_list('connect','http'),principal_name=>'AIUSER',principal_type=>xs_acl.ptype_db)); END; /

Verify the ACL entries.

SELECT host, principal, privilege FROM dba_host_aces;

---

Step 7 – Create AI Profile

Connect as AIUSER and create the AI Profile.

BEGIN
  DBMS_CLOUD_AI.CREATE_PROFILE(
    profile_name => 'COHERE_PROFILE_COMPAT',
    attributes => '{
        "credential_name": "COHERE_CREDENT",
        "model": "command-a-03-2025",
        "provider_endpoint": "api.cohere.ai/compatibility"
    }'
  );
END;
/

Enable the profile.

EXEC DBMS_CLOUD_AI.SET_PROFILE('COHERE_PROFILE');

Verify the active profile.

SELECT DBMS_CLOUD_AI.GET_PROFILE FROM dual;

---

Step 8 – Test SELECT AI

Generate SQL from Natural Language.

SELECT DBMS_CLOUD_AI.GENERATE_SQL(prompt=>'List all employees') FROM dual;

Or use the SELECT AI syntax (supported clients only).

SELECT AI 'List all employees' FROM dual;