--memory, --memory-swap, --cpus, --cpu-shares: what each flag really enforces, how OOM kills show up as exit code 137, and how to size limits you can defend.
