Why must you set JVM heap relative to the container memory limit, and what's the failure if you don't?

A container memory limit is enforced by the kernel cgroup; if the JVM's heap plus non-heap (metaspace, thread stacks, direct buffers, code cache) exceeds it, the kernel OOM-kills the process and Kubernetes restarts it — often misdiagnosed as a memory leak.

Modern JVMs honor cgroup limits via UseContainerSupport and you set MaxRAMPercentage (e.g. 75%) so heap leaves headroom for non-heap, rather than hardcoding -Xmx and forgetting off-heap usage. Set the container limit and the JVM sizing together, and remember a memory limit overage is a kill while a CPU limit overage is mere throttling.