@speckled on resource control, I advise to use cgroups like https://github.com/juju4/ansible-osquery/blob/master/tasks/cgroups.yml (initial tips from trailofbits)

a late thank you! for the suggestion of cgroups. this looks a good solution for additional insurance, we'll look into it