Skip to content

How to Deploy an AI Agent to Production in 5 Minutes

You built an AI agent. It works on your machine. Now you need it running in production — on a schedule, with proper isolation, secrets management, and logs you can actually read.

The gap between "works on my laptop" and "running in production" is where most AI agent projects die. Here's how to close it in five minutes flat.

What "production" actually means for an AI agent

An AI agent in production isn't just code that runs. It needs:

  • A runtime environment with the right Python version and dependencies
  • Secrets (API keys, tokens) injected at runtime, never in source
  • Isolation — one agent should never touch another agent's data
  • Scheduling — cron, on-demand, or always-on
  • Observability — run history, logs, token usage, duration

Setting this up by hand means Dockerfiles, IAM policies, container registries, schedulers, and log aggregation. That's days of infrastructure work — before your agent ever runs.

HollowHost collapses all of it into a single deployment step.

Step 1: Install the CLI

curl -L https://download.hollowhost.com/latest/hollowhost_darwin_arm64.tar.gz | tar xz
sudo mv hollowhost /usr/local/bin/

curl -L https://download.hollowhost.com/latest/hollowhost_linux_amd64.tar.gz | tar xz
sudo mv hollowhost /usr/local/bin/

Then authenticate:

hollowhost login

The CLI is the primary interface for developers. It handles auth, deployment, secrets management, and log streaming — all from your terminal. (See the full CLI reference for every command.)

Step 2: Prepare your repository

HollowHost deploys from a GitHub repository. The minimum requirements:

  • A Python file exposing a handler(event, context) entry point
  • A dependency manifest — requirements.txt (pip) or pyproject.toml (uv)

A minimal example:

main.py
def handler(event, context):
    print("Hello from my first HollowHost AI Job!")
    return {"ok": True}

Push this to GitHub — public or private. If private, you'll provide a GitHub PAT with repo read scope during setup.

Step 3: Create the AI Job

hollowhost ai-jobs create \
  --repo you/your-agent-repo \
  --lang python \
  --pm uv \
  --entry-point main.py

HollowHost clones your repo, inspects it, and validates the setup. You can target a specific branch with --branch and a monorepo subdirectory with --sub-path.

Status moves from VALIDATING to VALIDATED.

Step 4: Add your secrets

hollowhost ai-jobs env import <ai-job-id> --file .env

The CLI presents an interactive picker — it auto-detects sensitive keys (anything containing KEY, SECRET, TOKEN, PASSWORD) and offers to promote them to secrets. Values are never displayed in the terminal.

Secrets are encrypted at rest and injected at runtime. They never appear in logs, build output, or image layers.

For CI/scripts, use the non-interactive mode:

hollowhost ai-jobs env import <ai-job-id> --file .env --secrets "OPENAI_API_KEY,DATABASE_URL"

Step 5: Deploy

hollowhost ai-jobs deploy <ai-job-id> --follow

Behind the scenes, HollowHost runs a multi-stage pipeline:

  1. Build — produces a container image in an isolated environment
  2. Provision — creates a dedicated IAM execution role scoped to this agent
  3. Deploy — registers the agent on its isolated runtime

Status transitions from DEPLOYING to DEPLOYED. The --follow flag streams build progress in real time.

Step 6: Run it

hollowhost ai-jobs run <ai-job-id> --follow

Your agent executes in its own isolated environment. You get:

  • Real-time logs via hollowhost runs logs <ai-job-id> <run-id>
  • Run history with status, duration, and token usage
  • Cron scheduling — hollowhost ai-jobs update <ai-job-id> --schedule "0 */6 * * *" to run every six hours

What just happened

In five minutes, you went from source code to a deployed, isolated, production-ready AI agent — without writing a Dockerfile, configuring IAM, or standing up a scheduler.

The agent runs on AWS under its own least-privilege execution role. It can read only its own secrets, write only its own logs, and reach only the services you explicitly allow. No cross-agent access. No privilege escalation.

Next steps