Run an AI Log-Analysis Agent in an Upsun Task Container

This is Part 2 of the Upsun Task Containers series. In Part 1 we used a lightweight cron to trigger a task container for a heavy database job. Now we keep the exact same trigger pattern — but the task launches an AI agent instead of a shell command.

In Part 1, the task ran a deterministic command: reindex, import, export. That is the natural first step. But a task container is also the ideal home for something less deterministic and more interesting: a background AI agent that reads your project’s logs, reasons about them, and reports back. In this episode we build a small but real agent. On a schedule, a cron triggers a task container that runs OpenCode over your cron and application logs. The agent summarizes what happened, flags anomalies (slow crons, repeated errors, suspicious patterns), and writes a Markdown report — visible in the task logs and saved to a temporary file. No issues created, no pull requests opened yet: just a clean, automated reading of your logs. That groundwork unlocks the autonomous Auto-RCA agent we build in Part 3.

Task containers are currently in prerelease. To enable them on your project, open this prepopulated support ticket and add your project ID before submitting.

Prerequisites

Before starting, make sure you have:

Completed Part 1, or are comfortable with the cron-triggers-a-task pattern
An Upsun account with task containers enabled
The Upsun CLI installed
An API key for at least one LLM provider (for example Anthropic, OpenAI, or Google Gemini)
Familiarity with How to Host OpenCode on Upsun and, optionally, How to slash OpenCode Token costs by 90% on Upsun

The architecture

The flow is identical to Part 1 — a cron mints a token and triggers the task — except the task now runs a Node.js entry point that drives OpenCode: The agent stays deliberately simple. It does not need the Upsun API token, GitHub access, or write permissions on your repository — it only reads logs and produces text. We add those capabilities, step by step, in the next episodes.

Step 1 - Define the agent task

The task runs a nodejs image and pulls in the opencode-ai package as a dependency so the opencode binary is available at runtime. The container profile is bumped because LLM agents are memory-hungry.

.upsun/config.yaml

tasks:
  loganalyzer:
    source:
      root: /
    type: nodejs:24
    container_profile: "HIGH_MEMORY"
    dependencies:
      nodejs:
        opencode-ai: "*"
    run:
      command: node agent/analyze.js
      timeout: 1800
    variables:
      env:
        OPENCODE_THEME: "opencode"
        HOME: "/app"
    hooks:
      build: |
        set -ex
        echo "Install Upsun Skills for OpenCode..."
        npx skills add https://github.com/upsun/ai --skill upsun -y
    relationships:
      app: "app:http"

Key points:

dependencies.nodejs.opencode-ai installs the OpenCode CLI into the task image at build time, so opencode run works without a separate install step.
hooks.build adds the official Upsun OpenCode skills. They are optional for pure log reading, but they make the agent Upsun-aware and set the stage for Part 3.
container_profile: "HIGH_MEMORY" gives the agent enough memory to run a model session comfortably.
relationships.app lets the agent reach the application over HTTP if you later want it to pull logs from an endpoint instead of the filesystem.

The token-optimization plugins from Part 2 of the OpenCode series work here too. Reading log files is exactly the kind of output-heavy workload that benefits from opencode-snip — well worth wiring in once your agent goes beyond a proof of concept.

Step 2 - Provide the LLM API key

OpenCode needs a provider key to talk to a model. Set it as a sensitive environment-level variable so it is injected into the task container at run time but never committed:

Terminal

upsun variable:create --level environment --name ANTHROPIC_API_KEY --sensitive 1

Sensitive variables are available to the task exactly as they are to applications — as environment variables — without appearing in your configuration or logs.

Step 3 - Write the agent

The agent is a small Node.js script. It collects the relevant log files, builds a focused prompt, runs OpenCode non-interactively, and writes the resulting report both to the task logs (so it shows up in the activity feed) and to a temporary file.

agent/analyze.js

#!/usr/bin/env node
'use strict';

const { spawnSync } = require('node:child_process');
const fs = require('node:fs');
const path = require('node:path');

// Log sources to inspect. Cron output lives in /var/log/cron.log; adjust the
// application log paths to match your framework.
const LOG_SOURCES = [
  '/var/log/cron.log',
  '/app/var/log/prod.log',
];

// Read the last N lines of each available log file, skipping missing ones.
function collectLogs(maxLines = 400) {
  const sections = [];
  for (const file of LOG_SOURCES) {
    if (!fs.existsSync(file)) {
      console.error(`Skipping missing log: ${file}`);
      continue;
    }
    const lines = fs.readFileSync(file, 'utf8').split('\n');
    const tail = lines.slice(-maxLines).join('\n');
    sections.push(`### ${file}\n\n${tail}`);
  }
  return sections.join('\n\n');
}

function buildPrompt(logs) {
  return [
    'You are a log-analysis agent running inside an Upsun task container.',
    'Analyse the cron and application logs below and write a concise health report.',
    '',
    'Your report MUST be valid Markdown with these sections:',
    '1. **Summary** — one paragraph on overall health.',
    '2. **Cron jobs** — for each cron seen, its outcome and duration if available.',
    '3. **Errors & anomalies** — repeated errors, stack traces, slow operations.',
    '4. **Recommendations** — concrete next steps, or "None" if all looks healthy.',
    '',
    'Be factual. Do not invent log lines. If a section has nothing to report, say so.',
    '',
    '## Logs',
    '',
    logs || '(no logs available)',
  ].join('\n');
}

function runOpenCode(prompt) {
  // OpenCode needs writable XDG dirs; /tmp is always writable in a task.
  const env = {
    ...process.env,
    XDG_DATA_HOME: '/tmp/opencode/data',
    XDG_CACHE_HOME: '/tmp/opencode/cache',
    XDG_STATE_HOME: '/tmp/opencode/state',
    XDG_CONFIG_HOME: '/tmp/opencode/config',
  };
  for (const dir of Object.values(env).filter((v) => v.startsWith('/tmp/opencode'))) {
    fs.mkdirSync(dir, { recursive: true });
  }

  const result = spawnSync('opencode', ['run', prompt], {
    encoding: 'utf8',
    env,
    maxBuffer: 32 * 1024 * 1024,
  });

  if (result.error) {
    console.error('Failed to start opencode:', result.error.message);
    process.exit(1);
  }
  return result.stdout ?? '';
}

const logs = collectLogs();
const report = runOpenCode(buildPrompt(logs));

// 1. Stream the report to the task logs (visible in the activity feed).
console.log('=== Log-analysis report ===');
console.log(report);
console.log('=== end report ===');

// 2. Persist it to a temporary file for the duration of the run.
const reportPath = path.join('/tmp', `log-report-${Date.now()}.md`);
fs.writeFileSync(reportPath, report);
console.log(`Report written to ${reportPath}`);

tmp and instance mounts are reset between runs. The /tmp report exists only while the task runs and is meant for inspection in the same activity. To persist reports across runs, write to a storage mount or push them to a service. Part 3 shows how to push results out of the task entirely (a GitHub pull request).

Step 4 - Trigger the agent from a cron

This is unchanged from Part 1: a tiny cron mints a short-lived token from the container-local broker and POSTs to the task run endpoint. Reuse the same trigger script, pointed at the new task name:

bin/trigger-loganalyzer.sh

#!/usr/bin/env bash
set -euo pipefail

token="$(curl -fsS http://localhost:8200/oauth2/token \
  -d grant_type=client_credentials | jq -r .access_token)"

curl -fsS -X POST \
  -H "Authorization: Bearer ${token}" \
  "https://api.upsun.com/projects/${PLATFORM_PROJECT}/environments/${PLATFORM_BRANCH}/tasks/loganalyzer/run"

And the cron plus the authorization that lets the app trigger the task:

.upsun/config.yaml

applications:
  app:
    type: php:8.5
    # ...
    authorizations:
      - type: task
        resource: loganalyzer
        action: operate
    crons:
      hourly-log-analysis:
        spec: '0 * * * *'
        commands:
          start: |
            if [ "$PLATFORM_ENVIRONMENT_TYPE" = "production" ]; then
              bash bin/trigger-loganalyzer.sh
            fi

Step 5 - Deploy and read the report

Commit and push:

Terminal

git add .upsun/config.yaml agent/analyze.js bin/trigger-loganalyzer.sh
git commit -m "Add AI log-analysis agent in a task container"
upsun push

Trigger a run manually to test it without waiting for the top of the hour:

Terminal

upsun ssh -e main "bash bin/trigger-loganalyzer.sh"

Then open the activity for the task run and read the streamed report:

Terminal

upsun activity:list --type environment.task -e main
upsun activity:log <activity-id> -e main

The agent’s Markdown report appears between the === Log-analysis report === markers, and the path of the saved /tmp copy is printed at the end.

Wrapping up

You now have an AI agent that runs on a schedule, reads your logs, and writes you a health report — all inside an ephemeral task container, with nothing extra running between invocations. The agent stayed read-only and self-contained, which is exactly what you want before handing it more power. In Part 3, we give the agent that power. Instead of reacting on a schedule, it reacts to every 500 error in production: it analyzes the incident with the Upsun MCP server, opens a GitHub issue, and submits a pull request that closes it. That is the full Auto-RCA agent — see you in the next episode.

​Prerequisites

​The architecture

​Step 1 - Define the agent task

​Step 2 - Provide the LLM API key

​Step 3 - Write the agent

​Step 4 - Trigger the agent from a cron

​Step 5 - Deploy and read the report

​Wrapping up

Prerequisites

The architecture

Step 1 - Define the agent task

Step 2 - Provide the LLM API key

Step 3 - Write the agent

Step 4 - Trigger the agent from a cron

Step 5 - Deploy and read the report

Wrapping up