What cgroups v2 Really Does When You Set Docker Memory Limits

How Docker --memory and --cpus map to cgroups v2 memory.max and cpu.max, why the OOM killer fires with exit 137, CPU throttling, and a sizing procedure that works.