Adding to this, glad systemd-oomd finally added solid rulesets in 261

Made it far easier to target any containers that got too hot rather than ever risk anything higher priority.