Built from a Dockerfile by the agent, run under a Quadlet-generated systemd unit, capped at 128 MB and 50% of a core, published on loopback only.
runtime: container