I wonder if you can identify which cgroup(s) the containers run in and limit the memory of the containers that are consuming toouch memory.

https://medium.com/@kasunmaduraeng/docker-namespace-and-cgroups-dece27c209c7