Well I'm guessing that the 128MB is physical memory allotted to you. This has no bearing on the amount of virtual memory your applications can use though. Apache probably allocates a bunch of memory up front, but uses very little of it. That is why it is using a bunch of virtual memory, but little physical memory.
Remember that in Linux, malloc() is always guaranteed to return non-NULL as long as you have the virtual address space available. In other words, you can do this:
The moral of this story is that it is very hard to track how much physical RAM is available on a Linux machine. Any RAM that is not being used by applications will probably get used by the kernel to cache I/O requests to disks. I'm not sure how this is managed by a virtual private server though.
unsigned char* mem_hog = malloc( 1GB );
// Linux will always return a valid pointer, even if you don't have 1GB of RAM available. After
// the above call, your application will be using 1GB of virtual memory, but very little physical
memset(mem_hog, 0, 1GB );
// The call to memset() will now require you to have 1GB of memory available. That means
// your available RAM plus your available swap space needs to be at least 1GB. If you look
// at memory usage after this call, your physical memory usage will jump way up. It may not
// equal 1GB though, because chances are that some of that 1GB will be swapped out to