Set a memory limit, and keep it equal to the request

Memory cannot be throttled. When a container uses more than its memory limit, the kernel may end it with an out-of-memory (OOM) kill. When a node runs out of memory, the kubelet evicts Pods to recover.

The Kubernetes security checklist recommends setting memory limits equal to or less than the request, because a limit above the request lets a Pod use memory the scheduler never reserved for it. Several such Pods on one node can push the whole node into memory pressure and take healthy neighbours down with them.

Setting request and limit to the same value gives you predictable behaviour: the Pod gets exactly what it asked for, and if it leaks, only that container restarts.

• Watch for OOMKilled in kubectl describe pod and in restart counts.
• If a container is OOM killed often, raise both numbers together, or fix the leak.
• For runtimes with their own heap settings (JVM, Node.js), size the heap below the limit so garbage collection kicks in first.