Vultr AI apps: place the model before you size the VPS

Separate orchestration, application, model and accelerator before choosing RAM

“An AI app on Vultr” is not one runtime. Orchestration schedules workflows and retains credentials; application/UI holds sessions, documents, embeddings and authorization; model runtime loads model weights plus input-context state; accelerator or external provider executes compute under a separate data/cost boundary. A runbook that combines all four with “7B VPS” sizing can spend aggressively while still exposing keys or a causal resources problem.

On a host prepared via setup, n8n alone may have a hosted model as integration; deploy that once in n8n reference. A private Ollama that can be reached only from local test client is introduced here without duplicating an n8n stack. Model/API controls are part of task requirements, not later cloud “optimization.”

Draw the real prompt, file and secret path before purchase

Make a four-lane diagram after choosing architecture: requester/n8n → application → runtime → accelerator/provider. Label request id (not prompt), raw input file/images/sensitive documents, metadata, embeddings/vector DB, model name/source, gateway/session logs, responses/attachments, connected email/chat/calendar actions, compaction and telemetry location, credential encrypted store and backup location for each arrow. “Vultr-hosted” alone cannot establish local-only inference or no third-party retention.

Stop if authorizations forbid sending a production document to configured API, restore backup would embed action-taking webhooks, agent plugin origins are untrusted, or provider billing/source route cannot be budgeted. Bad prompt speed does not justify opening anonymous control/model endpoint to the world. Access prerequisite: actual accepted OS with docker compose, a private project intended by you, no valuable undeclared data, bounded integration test not connected valuable account.

Budget resident and transient memory, not model names

On selected host record actual low/no-workload and representative workflow resource windows. Do not estimate on top of a provider’s RAM marketing number alone; measure OS+services+db+app and cache that cannot be reclaimed when needed, plus your safety allowance. For GPU capture exact model/accelerator; a Cloud GPU’s 16 or 48GB VRAM might be different from system RAM.

free -h; swapon --show
lsblk -o NAME,SIZE,FSTYPE,TYPE,MOUNTPOINTS; df -hT
ps -eo pid,user,comm,%mem,rss --sort=-rss
if command -v docker >/dev/null 2>&1; then docker stats --no-stream; fi
if command -v nvidia-smi >/dev/null 2>&1; then
  nvidia-smi --query-gpu=name,memory.total,memory.used,driver_version --format=csv,noheader
else
  printf '%s\n' 'No selected GPU inventory: CPU branch only.'
fi

Budget formula to use per tested workload, not traffic gold rule:

Resident = OS + database + n8n/app + model runtime + resident weight/inference allocation + context KV/output + concurrency + safety headroom. Weight download consumed disk before model run and can coexist with temporary archives/cache. Context KV may grow with retained context/size/batch/group constraints; Output and nested jobs may generate more process/temporary usage. Your 4GB OS+DB+app share can leave insufficient room even when weights fit, while enabled swap can postpone OOM but not guarantee acceptable time.

Disk = actual model downloaded/cache + n8n/database/execution histories + temporary conversion/compaction + assets/checkpoint metadata/output + data/export/staging + runtime/OS updates + safety headroom. Model cache sharing with cohosted work demands a storage allocation with correct durable mount; local VX1 scratch, boot storage, Block Storage and ordinary Cloud NVMe are not interchangeable “disk included.”

Dated official example Vultr Ollama CPU guide used DeepSeek R1 1.5B with 1.1GB disk. Ollama library deepseek-r1 also uses tag 1.5b; minimal selected small example qwen3:0.6b was 523MB on official library. Neither number proves resident memory. Check exact tag, license, supported archive contexts and download before use. “4GB” can be a considered one tiny-model/short-context/one-request hypothesis if actual headroom fits, “8GB” a modest quantized larger-model experiment if real weights/context/runtime fits, and 16GB+/separate/external/GPU when evidence demands it; none are measured minimum. This guide intentionally makes no tokens/sec.

Hosted model shift reduces local weights/KV/VRAM but may increase confidentiality, data-transfer, field redaction, credentials, per-API spend, rate limiting or availability concerns; record these next to memory saving. A long context, low disk or bad API throttling cannot be answered by buying generically more RAM blindly.

A bounded Ollama CPU reference on a discovered host

This is an AiXVPS custom reference, not a Vultr-managed model service, inference-rate guarantee, or automatically installed Marketplace Ollama image. Preaccepted host supported Ubuntu/Docker Compose here. Current official Ollama Docker guide shows ordinary root container model location /root/.ollama and CLI, not universal production root privilege. Pin chosen image here at 2026-11-05 tag 0.40.15 with digest listed by registry capture; check official release notes on execution. Default-loopback only, Linux standard image utilization; no CUDA assumption even if Ollama might make use of other GPU on a specifically supported separate composition.

sudo -i
install -d -m 700 /opt/aixvps/ollama
printf '%s\n' 'AiXVPS Ollama private bounded reference; first create only known new scope' \
  > /opt/aixvps/README  # only if none; inspect any existing file first
test ! -e /opt/aixvps/ollama/compose.yml || {
  printf '%s\n' 'Existing Compose: preserve/discover, do not overwrite or prune model volume.' >&2
  exit 1
}

Store the following exact /opt/aixvps/ollama/compose.yml. Only loopback 127.0.0.1:11434; no 0.0.0.0:11434, blanket public firewall, privileged flag or / bind.

name: aixvps-ollama

services:
  ollama:
    image: ollama/ollama:0.40.15@sha256:0e59999e0e8f9fd4e704bd788a89b7e4cad399367fb1365f8c102ac662288761
    restart: unless-stopped
    volumes:
      - model_data:/root/.ollama
    ports:
      - "127.0.0.1:11434:11434"
    networks: [model]
    security_opt: [no-new-privileges:true]
    healthcheck:
      test: ["CMD-SHELL", "ollama list >/dev/null"]
      interval: 20s
      timeout: 10s
      retries: 4
      start_period: 30s

volumes:
  model_data:
networks:
  model:

Using current image UID/name, validate config, pull exact digest start and ask local version/list:

cd /opt/aixvps/ollama || exit 1
docker compose config --quiet
docker compose pull
docker compose up -d
docker compose ps
curl --fail --silent --show-error --max-time 10 http://127.0.0.1:11434/api/tags
docker compose exec ollama ollama list

Validate host resource/hard usage after pull before downloading large model. Only use model library exact selected authorized tag. Small test qwen3:0.6b has available tag-checked library page above; its privacy/training-data/weights licenses need current checking, what this test owns is non-sensitive prompt and output. It is an example because its official library page gave a concrete small format/size, not because it passed a performance or accuracy test here.

cd /opt/aixvps/ollama || exit 1
df -h /var/lib/docker
docker compose exec ollama ollama pull qwen3:0.6b
docker compose exec ollama ollama show qwen3:0.6b
curl --fail --show-error --max-time 180 http://127.0.0.1:11434/api/chat \
  -H 'Content-Type: application/json' \
  --data '{"model":"qwen3:0.6b","messages":[{"role":"user","content":"Reply with exactly: sandbox ready"}],"stream":false,"options":{"num_predict":32}}' \
  -o /root/aixvps-model-smoke.json.tmp
chmod 600 /root/aixvps-model-smoke.json.tmp
python3 -m json.tool /root/aixvps-model-smoke.json.tmp
rm -- /root/aixvps-model-smoke.json.tmp

Only the store protected local manual-response contains no user-data. Your firewall and host listener checks must show loopback-only. The exact model license/digest and expected output text can be recorded in pricing/consumption note after you inspect actual output. A reply proves the selected tag responded to a short smoke, not output accuracy, concurrency, latency/throughput, security audit or suitability for all tasks.

Observe resource pressure and apply a stop/resize/split decision

Keep second protected host shell open for observation and a before/after record while making one non-sensitive request. Stop if RAM beyond your reserve, OOM/swap pathology, persistent load/near disk-full, process exit/timeout, unapproved external route, or unknown credential/prompt handling appears. Do not expose endpoint as a sort of load generator.

date --iso-8601=seconds
free -h; swapon --show; df -hT /var/lib/docker
cd /opt/aixvps/ollama || exit 1
docker stats --no-stream ollama-ollama-1
docker compose logs --no-color --tail=100 ollama
sudo journalctl -k --no-pager --since '10 min ago' | grep -Ei 'oom|out of memory|killed process' || true
curl --fail --silent --show-error --max-time 10 http://127.0.0.1:11434/api/ps

Container docker ps actual ID/name can differ; inspect before replacing expected name. Kernel OOM evidence includes killed process. Capture actual modes: image+model tag+digest relevant, manifest distribution/file sizes; disk before/after; free available/RSS observed; named short context/action; code concurrency; response/error outlines; reserved headroom; temperature or hardware if GPU necessary without promoting unsupported inference numbers. An operator elapsed optional timing may belong but no token/sec claimed here.

Escalate only if live tested supported alternative architecture and invoice budget favor it: smaller measure-sufficient model/quantization; host resize (data/product eligible); move private model runtime; approved hosted model; specific GPU with required driver/VRAM. VX1 local volumes remain expendable and cannot rely on ordinary backup behavior.

Deleting a tested model must specify its exact name and be checked that no accepted workload uses it. No indiscriminate volume deletion:

cd /opt/aixvps/ollama || exit 1
# Only after recording a selected test-only model and downloaded manifests.
# docker compose exec ollama ollama rm qwen3:0.6b
# docker compose down     # leaves named model_data volume

down is test cleanup of named services not destruction billing; see final recovery and audit before provider instance.

Integrate privately with n8n or a UI without publishing inference

Same controlled topology can make an n8n service reach model via a Compose-internal URL http://MODEL_SERVICE:11434 only when both are deliberately on a model/backend network. Entry no host bind needed if no local monitoring requires. This guide intentionally shows a loopback single-service file for straightforward local smoke. To attach the separate n8n project, discover supported multi-compose/externally shared network name, firewall/auth/proxy controls and ensure no dependent OpenClaw job joins it. Do not simply copy its service key (ollama vs MODEL_SERVICE) and overwrite n8n/Postgres networks. Custom integration design must keep proxy-backed n8n and DB separate.

The Ollama API exposes model endpoints that need constrained network/policy around them for self-host. Model list and idle endpoints are not authentication proof. For a same-host n8n integration, test using explicitly supported n8n Ollama/Ollama node auth base area and chosen version’s node docs, rather than specifying an unsupported remote option. n8n article remains full backend/proxy architecture.

OpenClaw is a privileged agent with external data paths

Reviewed Vultr-labs OpenClaw listing explicitly describes an AI assistant using Ubuntu 24.04, Code Server/Docker/Homebrew, shell, skills/subagents and email/calendar/chat connections; displayed v2026.9.6. Product’s name co-occurrence in other provider panels does not merge this with a generic hosting panel. Its “browser+Docker+shell” control makes general model resource fit table insufficient.

Before connecting anything:

• Discover delivered exact agent/service/runtime versions, systemctl and Docker units, config ~/.openclaw/openclaw.json after inspecting actual UID, actual routes/port owners (Code Server / Gateway/admin), keys/tokens locations, sources/update route. Preserve .n8n-like not universal application behavior: recover its actual persisting path from docs.
• Read listing credential-delivery/secret handling, use your own password-manager unique password, not the displayed Username/Password example. Restrict browser/Code Server/origin sources and route to owner-authenticated TLS or accepted private path; the before-deploy no-default-public-port rule applies.
• Inspect configured inference model, embeddings, memory/summarization/compaction/telemetry, retrieval/download or connected email/calendar/chat APIs at runtime; include/subagent models separately. Listing DeepSeek compaction detection is not a no-egress proof.
• Start alternate restricted accounts/read-only scopes, rate/action budgets under accepted risk. Human approval before purchase, send/publish, deletion, production webhook or sensitive query. Untrusted plugin/skill/CLI/desired post text never authorizes tool action; human workflow is affirmative gate.
• Have kill/revoke/rotate of agent and API external sessions ready, output logs classified appropriately, redacted audits and protected backup of its configuration/user state as relevant. Agent suggestion to run curl | sh, install ClawHub extensions or use sudo stays unapproved command until reviewed.

Agent cost must combine Cloud Compute/GPU if chosen, attached storage/backups/outbound/registry egress, external per-model/per-chat tool fees, rate caps and licensing. Even actual use shows executions; this article gives no latency and no agent quality claim. Privacy/risks gate before an alternate account not after bulk real-data connection.

ComfyUI and Cloud GPU are separate from a shared CPU host

The reviewed Vultr ComfyUI listing identifies an AI image app with separate login, service, runtime/model files and version behavior to inspect; “Latest” is not permanent hardware/compatibility guarantee. A GPU image depends on actual selected driver/hw/workflow. Follow official Cloud GPU docs and actual selected image instructions, not shared Regular sizing.

On your actual GPU host read nvidia-smi if appropriate + actual ComfyUI port/owner/config/model directories, OS supported/updated, installed vendor/Marketplace suite components and actual systemctl/listeners. Before downloading exact selected checkpoint/LoRA/plugins check current license/source context and system RAM/VRAM/storage. Every chosen custom model can have distinct context/component/pixel/batch memory; not universal “xGB GPU handles image model.”

The dated A16 API price example $0.471/hour, monthly shown $344 (computed floor 343.83 rounded display difference) and L40S $1.671/GPU-hour/$1,122.91 API monthly are specific captured plan rows, not stock/latency/performance/cap across GPUs. At the source check latter’s location list was empty; actual per-SKU stock still needs live availability, not marketing 34 region. Standard Cloud GPU has ordinary non-GPU 730-hour versus general non-GPU 672 calculation documented and is outside standard network/host-node SLA (compute docs captured). Cloud GPU Cloud Storage FAQ has best-effort restores / refund on request wording not data-loss promise and canonical API/SKU price lookup at live order. No guarantee that generic machine-design backup is attached.

Budget operator selects explicitly:

Selected exact GPU hourly captured rate × approved bounded hours
+ system disk/data/checkpoint storage + backup independent target
+ intended outbound/download/output storage / possible excluded-traffic ledger
+ optional model/tool/license and regional price/tax
+ restoration-run management hours
= budget to verify at live order, not an invoice/cap guarantee

Define end time before your operator purchases/launches a selected GPU test; Stop ≠ stop charges. When exact work/manifest + model file/output/compatibility + DB/credentials have final preservation and exact restore, source writer frozen, then target-destroy in current official panel and all resources/invoice audit. A stopped high-hour compute VM waits for invoice and background activity; direct uninstall isn't cancellation either.

Weights, documents and actions retain owner obligations

Obtain weights and plugins from precise verified origin/tag/checksum/license and verify sources may change at update. Image-model training data terms, prompt/image/document/message consent, upstream/user license and embedding/vector rights remain operator responsibilities. No mass scraping, spamming, public auto-posting, anonymous/probing proxy, crypto mining or unsanctioned scanning examples or AUP evasion; n8n’s role scheduling doesn’t exempt external sources.

Before any contract/read/mail automate human-approved sample workflow and keep “side-effect none” evidence; MCP nodes/subagents/tool systems require the same safety. An approval to retrieve a document is not permission to publish answer/carry out purchase. When backup preserves secrets it requires encryption+protected retention rather than indiscriminate all-host tar. Record license/source/policy changes, weigh reversible files after rollback.

Vultr’s Marketplace/provided image = supported product pathway, not an independent application security audit, correctness guarantee or third-party application SLA. Hosted model outputs, agent tool actions and image content need usage-specific validation and human control.

Resize, split, external-model, GPU or exit based on diagnosis

If splitting, complete model/checkpoint/customization manifest; identify config+runtime selected image/digest, URLs/keys/network route/server firewall; restore read-only on existing nonfinal host, get expected callback and ephemeral output response and no external action, then final-quiesce/copy/restore exact cutoff before old-writer stop and destroyed state. Add its own backup before new write workloads. Total candidate cost is model/provider/API plus OS/resources, region product, storage/backup, egress/reprovisioning and recovery—not simply comments “CPU is slower” or “GPU has more VRAM.”