Avoiding the OOM Killer by Quotas?

Reserving memory in advance is a useful operation - so you can fail earlier if memory is short. Even if your app does have full checking of all allocations with rollback when necessary, it may just be easier for all concerned to refuse the incoming connection if there probably won't be the resources to service it. I think I would still prefer that malloc() of ten megabytes would reserve that space - not just pretend to succeed and then dynamite my process at some undetermined later point. But for handling legacy or 'lazy' code which prefers to rely on overcommit, a mixed model such as those you suggest could work.