Why cgroup’s memory subsystem use oom-killer instead of return memory allocation failure when progress allow memory over cgroup limit？

Question

We use cgroup limit procedure use more resource。 but，when Memory is more than limit in cgroup，it will kill process。 Why cgroup’s memory subsystem use oom-killer instead of return memory allocation failure when progress allow memory over cgroup limit？

Answer 1

It appears that cgroups can either use oom-killer or pause the process (https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/sec-memory.html). But with ulimit, the allocation simply fails normally.

Some unanswered questions remain: Is there a away to get cgroups to deny the process memory (return NULL from malloc)? Or is there a way to get ulimit to deny physical memory (-m) rather than only virtual (-v)?