A cgroup limit is not what /proc/meminfo says

A container reads the host’s memory and CPU counts from /proc, because those files are not namespaced, and anything sizing itself from them sizes for the wrong machine.

$ docker run --rm -m 512m alpine free -m | head -2
              total        used        free
Mem:          64267        8102       41220

# the real limit, cgroup v2
$ cat /sys/fs/cgroup/memory.max
536870912

# cgroup v1
$ cat /sys/fs/cgroup/memory/memory.limit_in_bytes

# and the sentinels: v2 writes the string 'max', v1 writes
# a number close to 2^63. neither is a real limit.

The two sentinel values are what catch people writing this by hand — treating either as a limit produces a pool sized for nine exabytes. The consequence of getting it wrong is a process killed by the OOM killer with exit code 137 and no log line, which is one of the least informative failures in the whole stack.