Why does a container get OOMKilled even though the node it's running on has plenty of free memory?

OOMKilled is triggered by the container exceeding its OWN configured memory limit, enforced by the kernel's cgroup memory controller — it has nothing to do with how much memory the broader node has free; a too-tight limit kills a container even on an otherwise idle node.