A process needs file descriptors for more than ordinary files. Network sockets, pipes, event interfaces, and duplicated references all compete for entries in its descriptor table. RLIMIT_NOFILE limits the descriptor numbers available to new allocations: the soft limit is one greater than the maximum permitted number. A service can therefore fail to accept work even while the machine has plenty of disk space and memory. ...
Linux can invoke an out-of-memory killer when an allocation cannot be satisfied within its relevant constraints after appropriate reclaim attempts. It is a last-resort recovery mechanism, not an application priority scheduler. Some allocations fail without a kill, and configuration can instead lead to panic behavior. Start an investigation by identifying the allocation scope and recorded event, rather than declaring that the machine must have exhausted every byte of RAM. ...
A firewall applies packet policy at particular points in a network stack. A useful rule therefore names more than a port: its address family, hook, direction, state conditions, and place among other rules matter. With nftables, base chains attach to Netfilter hooks at specified priorities. The effective packet path, rather than the order of descriptions in an operations document, determines which decisions a packet encounters. ...