Memory controls: pressure, hard limits, and OOM evidence

memory.high applies pressure and throttling to reduce usage through reclaim when the boundary is exceeded. Crossing high does not itself invoke the OOM killer, and usage can exceed the boundary. An application can still be killed for another reason, including other memory pressure, so observing high is not an explanation for every later exit. Use memory pressure and event counters to distinguish a workload spending time in reclaim from one that simply needs more CPU or waits for I/O.

memory.max is the hard-limit mechanism: when the charged usage cannot be reduced sufficiently at that boundary, cgroup OOM handling can occur. Temporary overshoot and allocation-specific failure behavior exist; not every failed allocation invokes the OOM killer. Swap has separate controls and affects whether anonymous memory can move out of RAM. Raising a limit changes containment and capacity tradeoffs, but it does not repair a leak or guarantee that enough physical memory exists for all siblings and the host.

memory.current includes the cgroup's charged memory and its descendants. A parent's total therefore already includes child totals; adding parent and child readings double-counts the hierarchy. Charged usage includes more than anonymous application payload, such as relevant page cache and kernel memory. Some detailed memory.stat fields overlap or refine broader categories, so adding every line is also wrong. Shared pages and charge ownership mean summing process RSS is not an equivalent measurement of cgroup usage.

A memory area can retain its existing charge ownership when a process migrates, rather than all historical pages moving immediately to the new cgroup. Ancestor limits can bind even when a child appears below its local limit. Observe the full path and the controller's documented event scope: memory.events is ordinarily hierarchical, while memory.events.local reports local events, subject to relevant mount behavior. A group OOM policy can treat a workload as a unit, but protected tasks and the chosen policy prevent a universal statement that every process must always be killed together.

A conventional exit status of 137 often encodes termination by signal nine, SIGKILL. It does not identify who sent the signal. An operator, orchestrator escalation, cgroup OOM, or another kernel event can produce a superficially similar result. Correlate the same cgroup instance's memory events, kernel logs where available, process lifetime, and runtime state. A restarted workload with reset counters must not be mistaken for the earlier instance. The nearest dashboard spike is not enough to establish the causal path.

The function lab illustrates a workload's possible quadratic payload component. Reset, explicitly set a=1 and x=1, predict y=1, then Play or Step; Reset and explicitly set a=1 and x=2 for a separate prediction of four. Interpret x as normalized sequence length for one dense square allocation under a stated model. The graph does not simulate memory.high, reclaim, swap, hierarchical charges, or OOM selection. Quadrupled payload can motivate a budget check without proving that a particular process will be killed.