systemd-run for a one-off command with a memory limit

Running a large import by hand and having it take the machine down with the OOM killer is a recurring way to turn a routine task into an incident.

$ systemd-run --scope -p MemoryMax=1G -p CPUQuota=50% 
    php artisan import:catalogue

# it gets its own cgroup, so exceeding the limit kills the import
# and nothing else.

$ systemd-run --on-active=30m --unit=deploy-check /usr/local/bin/check.sh

The --scope form runs in the foreground and is the one to reach for interactively; without it the command is detached as a transient service and its output goes to the journal. The killed process is the one that exceeded the limit rather than whatever the kernel judged largest, which is the whole point — the default OOM behaviour on a busy host frequently kills the database. The timer form is useful for a one-off delayed check without editing a crontab.