This is exactly the conclusion I’ve just come to as well, after reading the proper Linux cgroups docs, as the docker container may not have exposure to sibling cgroups, so whatever that value is can’t reliably be interpreted.
cgroups is a very very odd design.
Anyway, I feel a bit validated by this decision as this was the conclusion that the JRE came to as well.
Thanks again for your help!