Why the Linux OOM killer killed your container when memory looked fine

A container can be OOM-killed while the node has gigabytes free. Here is how the kernel scores its victims, and the one knob that changes the score.