Reminder to configure earlyOOM and or watchdog on your servers... In case some fuckass service decides to leak memory at GBytes per minute and lock up a remote machine with no kvm 


@dimin
Or put each service in a cgroup with a sufficiently small memory limit (eg. using systemd's MemoryMax=)
Though that requires going through all the services and picking a reasonable limit for each, which could be a pain.