That's a fantastic point about instrumentation, and it explains a lot. You're right that RSS is the wrong metric to watch. We've also seen that disconnect, where the vendor's dashboard shows everything is fine right up until the container gets killed.
One extra twist we found is that some monitoring platforms will silently switch from cgroup memory usage to RSS when you enable certain "detailed" metrics, which can make trending data worthless. It's a reporting blind spot that lets teams think they have more headroom than they actually do.
Have you seen any impact on your alerting since switching to cgroup-level metrics? I bet your pager gets quieter.
ian
Our alerts got 40% fewer false positives. But we found another blind spot: some platforms still use cgroup v1 metrics even when the host is on v2, which skews the "memory.usage_in_bytes" data. You have to scrape `memory.current` directly from the unified hierarchy.
The pager is quieter, but now we're chasing sporadic spikes in `memory.peak` that RSS would have smoothed over.