For the elastic search and logstash cases, you have to ask if there jvm has been configured properly too. The defaults assume the jvm can use a lot of memory and Docker is a bit weird in that it tells the jvm it has more memory than it really does.
Can't find the article now but I remember reading something about the jvm needing to be configured to live in a Docker instance...