diff --git a/docker-compose.staging.yml b/docker-compose.staging.yml
index 605beb9a..c9bbc1f5 100644
--- a/docker-compose.staging.yml
+++ b/docker-compose.staging.yml
@@ -26,6 +26,10 @@ services:
         condition: service_healthy
     security_opt:
       - no-new-privileges:true
+    # Caps a runaway process, such as a stray `docker exec` command; normal use is about 5 GB and one core.
+    cpus: 4
+    mem_limit: 12g
+    pids_limit: 1024
     restart: unless-stopped
 
   db:
diff --git a/docker-compose.yml b/docker-compose.yml
index 6dc346dd..e9e17c90 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,6 +21,10 @@ services:
         condition: service_healthy
     security_opt:
       - no-new-privileges:true
+    # Caps a runaway process, such as a stray `docker exec` command; normal use is about 5 GB and one core.
+    cpus: 4
+    mem_limit: 12g
+    pids_limit: 1024
     restart: always
 
   # The site's Postgres (site records, Precedent and patch notes). backend/.env sets
diff --git a/docs/docs/ops/postgresql.md b/docs/docs/ops/postgresql.md
index e8aff615..9a3ccba7 100644
--- a/docs/docs/ops/postgresql.md
+++ b/docs/docs/ops/postgresql.md
@@ -33,6 +33,21 @@ PostgreSQL types; timestamp serialization and public JSON formats stay compatibl
 settings bound queries and locks. Domain advisory locks coordinate checks that span multiple rows or the
 absence of a row; file guards coordinate wardrobe and map assets across workers.
 
+### Looking up records by hand
+
+Site records such as `discord_links` are only in PostgreSQL. There is no live `province.db`; the
+`province*.db` files under `src/data/` are stale backups from before the move to PostgreSQL, so don't
+search the container's filesystem for a database. A recursive search from `/`, such as Python's
+`glob('/**/…', recursive=True)`, follows the looping symlinks under `/sys` and never finishes. Query the
+site's `db` service instead, with read-only SQL:
+
+```bash
+sudo -n -u tfmc /usr/local/sbin/ps-compose main exec -T db psql -U provincesystem -d provincesystem \
+  -c "select * from discord_links where lower(discord_username) like '%name%'"
+```
+
+Use `dev` instead of `main` for the Dev site.
+
 An hourly housekeeping loop in the backend, which also runs at startup, clears data that has outlived its use.
 It clears the plaintext of login codes that expired unused and deletes expired code sessions
 ([opaque Bearer sessions](../identity/auth-security.md#opaque-bearer-sessions)).