Containment-First Agent Runtime on Vultr

Containment-First Agent Runtime is a web-based agent that performs real work while keeping every action inside an isolated execution environment on Vultr. How it works: the control layer accepts a natural-language task, plans it into steps, and dispatches each step to a short-lived Docker sandbox. Code runs with no network by default, a read-only root filesystem, dropped capabilities, a memory cap and a burst CPU quota. A second executor drives a real headless browser through Playwright, also inside the sandbox. What makes it different: the API does not merely claim isolation. Every response returns the flags that were actually applied (no_network, read_only_root, cap_drop, memory_limit, cpu_quota, non-root user), so a reviewer can verify the blast radius instead of trusting a README. Planning uses Vultr Serverless Inference; when no key is configured the system reports local-fallback explicitly instead of pretending to call a model. The repository ships a 74-second demo with three containment moments, an architecture document, a six-page deck and a one-command deployment script for Vultr Cloud Compute. The runtime is verified end to end: POST /tasks with print(6*7) returns ok=true, exit_code=0, stdout=42.