xtables lock was missing. Added new option for oom-score to make sure it's not killed in an OOM situation before regular pods.