AI log-analysis agent

Context

Upsun launched task containers: short-lived containers that run a one-off job next to the application, with their own resources. I showcased them in a series of articles: first to offload a heavy cron-triggered job, then, here, to run an AI agent.

What I built

• Triggering: a cron, in production only, gets a short-lived token, then starts the task through the Upsun API. The application declares only a minimal authorisation: starting that one task.
• The agent (Node.js 24) reads the last 400 lines of the cron and application logs, then runs OpenCode with a strict prompt: four sections (summary, cron jobs, errors and anomalies, recommendations) and no invented log lines.
• The report shows in the project's activity feed and in a timestamped Markdown file.
• The model provider is interchangeable (Anthropic, OpenAI, Gemini).

Security first

• Read-only: the agent has no Upsun API token, no GitHub access, no write access to the repository.
• The LLM key is a sensitive variable injected at runtime, never in versioned configuration.
• An isolated container with a high-memory profile: the LLM session takes no resources from the application.

Technical challenges

• Running a CLI designed for a developer laptop in a short-lived container with a read-only filesystem: config directories redirected to a writable location, explicit timeout.
• Getting a reliable report: structured output, anti-hallucination prompt, truncated logs to keep token costs under control.

Result

A reusable architecture pattern for putting AI "in production" safely. The next part of the series adds autonomous incident response.