fail2ban with enormously large ban lists is prone to being killed by OOM. I'm not sure if the kernel uses cgroups for killing together or not, but I think this would be a problem if a cgroup limit w/ memory.max is set anyway.
We're using supervise-daemon now for the fail2ban init script, but it looks like supervise-daemon gets placed in the same cgroup as the process it is supervising, so both get killed together.
fail2ban with enormously large ban lists is prone to being killed by OOM. I'm not sure if the kernel uses cgroups for killing together or not, but I think this would be a problem if a cgroup limit w/ memory.max is set anyway.
We're using supervise-daemon now for the fail2ban init script, but it looks like supervise-daemon gets placed in the same cgroup as the process it is supervising, so both get killed together.