diff --git a/ci.sh b/ci.sh
index d4609bd..1dc4178 100755
--- a/ci.sh
+++ b/ci.sh
@@ -67,7 +67,14 @@ container_is_limited() {
   [ "$(in_image "$node_image" sh -c 'cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.swap.max' | tr '\n' ' ')" = '8589934592 0 ' ]
 }
 
-leg "an in_image container has equal memory and swap limits ($node_image)" container_is_limited
+leg "an in_image container is capped at 8g with no swap ($node_image)" container_is_limited
+
+# with_firefox and publish.sh start containers no leg here can inspect.
+every_docker_run_is_limited() {
+  ! grep -h 'docker run' docker-runner.sh publish.sh | grep -v -e '--memory "[^"]*" --memory-swap "[^"]*"'
+}
+
+leg "every docker run in docker-runner.sh and publish.sh names a memory and a swap limit" every_docker_run_is_limited
 
 test_log=$(mktemp)
 node_tests() {
diff --git a/docker-runner.sh b/docker-runner.sh
index 8b1b593..99aa036 100644
--- a/docker-runner.sh
+++ b/docker-runner.sh
@@ -6,7 +6,7 @@ firefox_image=selenium/standalone-firefox:159.0.1
 floor_image=node:18.20.8-alpine3.21
 node_image=node:26.13.0-alpine3.24
 
-# The test legs peak near 4.5g in the container's memory.peak, and a leg building strings near V8's longest fails when the limit is too small.
+# The test legs peak near 4.2g (cgroup memory.peak); below that, the tests building strings near V8's longest string fail.
 container_memory=8g
 
 # --init: the container's process 1 ignores a SIGINT it has no handler for, so without it Ctrl-C leaves the container running.