The government warehouse below Cloud Cliff was built entirely on aerial stone piers and heavy cedar stilts. Three sides of the hall hung over a deep ravine, above the roaring rapids of the mountain river.

Old Shen, who had managed the storehouse for thirty years, kept the most eccentric ledger in the county. The stilts beneath the floor had a bearing capacity of exactly one thousand storage bays. Yet if you added up the white-paper leases Shen had issued over the decades, the total came to three thousand.

This was no private graft; it was the accepted custom sanctioned by the magistrate’s yamen: overbooking.

Merchants from north and south leased storage bays purely for peace of mind. They claimed the maximum on paper, yet in ordinary seasons the hides, mountain teas, and ironware they actually delivered barely filled twenty or thirty percent of their rented quotas. As long as they did not all arrive with full wagons on the exact same day, the timbers held effortlessly, and the yamen collected triple the storage fees. For thirty years, the mountain breezes blew through the airy halls, and peace reigned.

Until the dead of winter, when an unprecedented cold snap struck the passes.

Panic swept through the mountain city in a single morning. Convinced that their livelihoods would freeze or be looted outside, every merchant hauled their entire accumulated harvest toward the warehouse. Mule carts lined the snow-slicked wooden approaches for miles. Grain dealers rolled in oil tubs as tall as two men; silk merchants stacked bales of tung-oiled raw thread; potters carried in heavy crates of ironstone glaze.

By nightfall, the cedar timbers began to groan with a sickening, grinding shriek. Beneath the piers, loose shale clattered into the river gorge below. The entire floor sagged half a foot under the monstrous burden. The bays were packed to the rafters; crates overflowed into the corridors until a man could not squeeze through sideways.

At that desperate hour, an apprentice boy from an herbalist’s shop pushed through the heavy doors, gasping for breath, clutching a single tiny wicker basket of dried licorice root.

The boy stood on tiptoe and gingerly set the basket down on the wooden floorboards just inside the threshold.

CRACK!

A thunderous snap exploded from the foundations. A center support strut, thick as a man’s chest, split clean down the grain with a two-finger gap. The floorboards visibly dipped toward the abyss, and the iron anchor cables along the cliff face screamed under the sudden tension.

Catastrophe. The beams had reached absolute structural failure. Unless tens of thousands of pounds were cleared within moments, the entire storehouse — goods, merchants, and keepers — would plunge into the gorge.

The apprentice collapsed to the floor in tears, wailing that his little basket of licorice had destroyed the county warehouse. Furious merchants surrounded him, shaking their fists, and one man lunged forward to seize the licorice and fling it out into the snow.

Old Shen raised his heavy abacus and barked: “Hold!”

He did not glance at the licorice.

“No horse in history was ever crushed by a blade of grass,” Shen said coldly. “Throw the grass away, and do you lighten the timbers by two pounds? This beam will still break.”

Shen unrolled his brass-bound tally ledger. On the edge of the abyss, he had to execute an irreversible judgment: designate one merchant’s stores and dump them down the mountain chutes into the river, restoring enough buoyancy for the framing to snap back into place. But deciding whose cargo died was governed by an iron rule:

First, never touch the bays bearing the Imperial Bronze Plate. Deep in the rock alcove lay three vaulted chambers locked with the magistrate’s seal and stocked with dried garrison grain. No matter how violently the floorboards bowed, Shen’s tally stick could never gesture toward those doors. That was royal immunity; touching it would trigger immediate rebellion across the border.

Second, strike the bloated monster. In a systemic crisis, casting out three small peddlers who stored a sack of ginger each would not shave enough weight to relieve the strut. If you must cut, you must cut the tenant who consumed the most vast, unwieldy mass of timber space.

Third, weigh the status of the lease. Casual hawkers who had paid only for “itinerant floor mats” had agreed in their contracts to be evicted first in an emergency; while ancient trading houses who had pledged family estates carried heavy covenants.

Shen’s tally stick flickered across the pages. He passed the garrison stores (shielded by royal immunity), passed the apprentice boy (his tiny load saved nothing), passed several frantic cloth merchants. Finally, the tip of his stick slammed down upon the account of Master Qian, the richest grain magnate on the river.

Qian alone had crammed seven hundred bushels of moisture-heavy wheat into his bay, and had secretly wedged twenty heavy lead-sealed storage vats behind them.

“Open the north river chute!” Shen ordered without a flicker of emotion. “Cut the trip-ropes! Release the floor latch!”

The warehousemen swung their axes. The counterweighted floorboards swung open into the night, and Qian’s seven hundred bushels of grain roared down the sheer cliff into the black rapids like a stone avalanche. A blast of wind and chaff surged up into the hall. The timber frame gave a long, shuddering sigh and sprang upward three inches, and the splintering sound below fell instantly silent.

The warehouse was saved.

Master Qian knelt at the edge of the chute beating his chest, mourning his fortune; while the apprentice boy, still cradling his little basket of licorice root, stood unharmed amidst the silent crowd.

— — —

By now you’ve probably recognized it: this is the operating system’s most ruthless survival mechanism — the Linux OOM Killer (Out-Of-Memory Killer) and oom_score_adj.

What it is

To extract maximum utility from physical RAM, the Linux kernel enables Memory Overcommit (vm.overcommit_memory = 0) by default. It is identical to Old Shen’s triple leases: when a program calls malloc(), the kernel only reserves virtual address space without immediately provisioning physical RAM. It gambles that the majority of processes will never write to all of their claimed memory simultaneously.

However, during traffic spikes or memory leaks, when processes actively write data into those pages (triggering page faults), physical RAM and swap space become completely exhausted. When kernel direct page reclaim can no longer free even a few pages, the system enters a fatal Out of Memory (OOM) condition.

To prevent the entire machine from experiencing a kernel panic or freezing irrevocably, the kernel’s mm/oom_kill.c awakens the OOM Killer. It selects a victim process and terminates it with SIGKILL (kill -9) to immediately reclaim its physical pages.

The OOM Killer never punishes the process that made the final, tiny memory allocation (it spares the apprentice boy). Instead, the oom_badness() function calculates an oom_score (from 0 to 1000) for every runnable task:

1. Base Badness: The proportion of physical RAM (RSS), page table allocations, and swap space consumed by the process relative to total available memory. The more bloated the process, the higher its score;
2. Heuristic Adjustment (oom_score_adj exposed in /proc/<PID>/oom_score_adj): Userspace can bias the verdict with values ranging from -1000 (OOM_SCORE_ADJ_MIN, completely immune from OOM sacrifice) to +1000 (OOM_SCORE_ADJ_MAX, first in line for termination).

Why it matters

In cloud computing and Kubernetes / OpenShift clusters, the OOM Killer is the supreme executioner determining which workloads survive node pressure.

Kubernetes maps a Pod’s resources.requests and limits directly into three Quality of Service (QoS) classes by configuring Linux oom_score_adj:

• Guaranteed: Containers where requests equal limits. Kubernetes sets their oom_score_adj to -997. System daemons like kubelet and containerd sit at -998 and -999. Unless every other user process on the node is already dead, the OOM Killer will never touch a Guaranteed workload;
• Burstable: Containers where requests are less than limits. Kubernetes calculates a score between 2 and 999 based on the percentage of memory requested relative to the node’s capacity. The more memory a container consumes beyond its request, the higher its badness score;
• BestEffort: Containers with neither requests nor limits configured. Kubernetes assigns them oom_score_adj = 1000. The instant node memory tightens, they are the very first to be executed.

Understanding this mechanism dispels one of production engineering’s most frequent mysteries: why a lightweight cron job requesting 4 KB triggered an alarm, but a giant, leaky Java container without memory limits was the one terminated with exit code 137 (128 + 9, SIGKILL).

In an out-of-memory crisis, justice is not about punishing the last drop of water. It is about smashing the largest, least-protected reservoir in the room.

Metaphor Mapping Table

• The aerial timber storehouse on wooden stilts — Physical RAM and Swap capacity
• Three thousand leases issued for one thousand bays — Linux Memory Overcommit (vm.overcommit_memory)
• Merchants rushing in with full wagons during the blizzard — Concurrent processes allocating and writing physical pages (Page Faults)
• The apprentice boy with the basket of licorice — The final tiny malloc call that triggers the allocation failure
• The splintering center beam and imminent collapse — Fatal Out of Memory (OOM) condition
• Old Shen’s tally stick and selection rules — The oom_badness() calculation algorithm
• The Imperial Bronze Plate on the garrison grain bays — oom_score_adj = -1000 (immunity from OOM sacrifice)
• The cheap itinerant floor mats — Kubernetes BestEffort QoS class (oom_score_adj = 1000)
• Trading houses with pledged estates — Kubernetes Burstable and Guaranteed QoS classes
• Master Qian’s 700 bushels of wet wheat and lead vats — A memory-hogging process (high RSS and swap) with no immunity
• Opening the floor chute to dump grain into the river — Sending SIGKILL (exit code 137) to reclaim pages
• The storehouse springing back and surviving — OOM Killer preventing a complete kernel panic and system lockup