DockerContainerOomKilled: what to do when it fires

Alert rule

alert: DockerContainerOomKilled
expr: increase(container_oom_events_total{name!=""}[10m]) > 0
for: 0m
severity: critical

Alert message: Container {{ $labels.name }} was OOM-killed ({{ $labels.instance }})

What it means

The kernel killed the container's process for exceeding its memory limit: the container_oom_events_total counter increased in the last 10 minutes.

Common causes

A limit that is too small, a memory leak, a load spike, wrong runtime settings (heap larger than the container limit).

Diagnostics

docker inspect <name> --format 'OOMKilled={{.State.OOMKilled}} exit={{.State.ExitCode}} limit={{.HostConfig.Memory}}'
docker logs --tail 100 <name>
dmesg -T | grep -i -E 'oom|killed process' | tail
docker stats --no-stream

How to fix

Raise the memory limit, bring the application settings in line with the limit, fix the leak. Watch for restarts — DockerContainerRestartLoop.

When it is OK to silence

It must not be left unattended: an OOM means a lost process. Acceptable on test setups.

Related alerts

• DockerContainerRestartLoop
• DockerContainerMemoryNearLimit
• DockerContainerCpuThrottled
• DockerContainerGone

The full pack of 44 tested rules + Alertmanager → Telegram: 790 ₽ (≈ $9, card payment in rubles)
Open in Telegram · Free Monitoring Lite kit · All runbook alerts