ominous ocelot

• journalctl shows the oom event
• Container limits you can limit container resource usage
• also you can look at container stats to maybe identify the culprit. Or cyclically write the stdout of ps to a file to identify the memory hungry process.

Debian + LVM + Incus :)

The h4 already can be a managed switch itself (2" 2,5gbit + 4*1gbit with the nic addon.) if you want it to be one. Linux as the host OS (VLANs, bridges) - netplan works well for me. Some VMs and containers on top (lxd, incus, some use proxmox) for router/ firewall/ vpn-gateway (opnsense, ipfire,…) and other functionality which you don’t want to run on the host OS directly. The cpu is fast enough to run all your services at once. It all comes down to RAM.

IMO there is not one right way. It all depends on what you want to achieve. Also a lot depends on, whether you want results fast or if you enjoy the tinkering while learning.