Have you shared bug reports / reproductions with LKML? I think facebook was going a bunch of work in this space. There were a bunch of improvements in 5.9, esp. with cgroup2.
In traditional Docker installs, you (can) run as real UID 0 (and many containers do) with CAP_KILL [https://docs.docker.com/engine/reference/run/].
Have you shared bug reports / reproductions with LKML? I think facebook was going a bunch of work in this space. There were a bunch of improvements in 5.9, esp. with cgroup2.
In traditional Docker installs, you (can) run as real UID 0 (and many containers do) with CAP_KILL [https://docs.docker.com/engine/reference/run/].