The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of
the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that
root, so it was never seen: on a bare host the root has no memory.max and
no soft limit was set at all, and inside an LXC/Incus container the limit
came from the container (2 GiB -> "1843 MiB") while systemd killed the
panel at 650M. Either way GC never tightened before the OOM kill.
Walk from the process's own cgroup (/proc/self/cgroup) up to the visible
root and take the tightest memory.max (cgroup v2) or
memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees
the same root limit as before.
Aleksey Fedorov