feat(content): implement consultant review recommendations (executive summary, dynamic cta, homelab cleanup)

src/content/posts/zh/docker-reported-exit-0-the-oom-killer-disagreed.md

@@ -1,12 +1,28 @@
 ---
-title: "Docker 说它干净退出，内核说它被 OOM 杀掉了"
-description: "NAS 上的容器不停「意外停止」，而 Docker 报的是 exit 0 / OOMKilled=false。真正的证据在 dmesg 里：六次 cgroup 内存击杀。"
+title: "Docker 报告退出码 0，内核却早已执行 OOM-Kill"
+description: "NAS 上的一个容器反复异常退出，Docker 却上报 exit 0 与 OOMKilled=false。真实的证据在 dmesg 里：六次 cgroup OOM-kill。"
 pubDate: 2026-10-16
 category: devops
 tags: ["docker", "oom", "traefik", "synology", "crawlers"]
 ogImage: /og/zh-docker-reported-exit-0-the-oom-killer-disagreed.jpg
 banner: /banners/docker-reported-exit-0-the-oom-killer-disagreed.jpg
 draft: false
+summary:
+  audience: "SREs, DevOps Leads & 系统工程师"
+  painPoint: "公网边缘反向代理容器（Traefik）4天内无预警重启7次，但 Docker daemon 谎报 ExitCode=0 且 OOMKilled=false，常规监控完全失明。"
+  impact:
+    - metric: "精准定位真凶"
+      detail: "穿透 Docker 状态假象，通过内核 dmesg 与 cgroup 内存水位线抓出 25,976 个代理爬虫 IP 引发的 512MB 触顶"
+    - metric: "0 停机热修复"
+      detail: "单容器精准扩容至 2GB 并锁死 Swap（防磁盘阵列雪崩），18分钟峰值回落至 210MB，连续运行 0 崩溃"
+    - metric: "防自锁诊断规范"
+      detail: "沉淀边缘网关高并发防爬虫压测与避免自身 IP 被 WAF 误封（403 假象）的排障 SOP"
+  stack: ["Docker", "Linux Kernel (dmesg/cgroups)", "Traefik", "Synology DSM", "Security Filtering"]
+  jumpLinks:
+    business: "#the-result"
+    architecture: "#the-kernel-keeps-its-own-record"
+    result: "#what-i-would-do-differently"
+dynamicCta: true
 ---
 
 ## 一条我以为又是配置写错的告警