How does the container use more memory than the limit?

Question

My project might be an overcommitted system, and I have to improve the reliability by specifying an appropriate container mem limit, by which the total mem of the node should not be divided. But I'm confused with the following statements in the Kubernetes v1.1 doc Resource of Qos :

Incompressible Resource Guarantees

• if they exceed their memory request, they could be killed (if some other container needs memory)

• Containers will be killed if they use more memory than their limit.

and the command docker stats shows a "LIMIT" for each container:

I think it means that containers will not use mems more than the "LIMIT" since I've met sometimes the MEM% stays at 100% for a while, so how and when the containers are killed?

Update

I think OOM Killer is enabled with the default value 0 .

> cat /proc/sys/vm/oom_kill_allocating_task
0

Answer 1

Cgroup memory limit feature is used, so I recommend to read cgroup doc:

Tasks that attempt to consume more memory than they are allowed are immediately killed by the OOM killer.

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/sec-memory.html