> has much more control over this than a typical non-container setup

Actually not true, k8s uses the exact same cgroups API for this under the hood that systemd does.