A cap can be set at several levels. A language runtime sets its own, such as PHP's memory_limit, which stops a single script from using more than a set amount. The operating system can limit a process with rlimits, or a whole group with a cgroup. A container platform sets a memory limit on each container, and a hosting plan sets one for each account.
The purpose is containment. If code leaks memory, receives a request that expands into a huge structure, or is being exploited, the cap stops the problem at a known point so that the machine as a whole keeps working. The affected process is slowed, refused more memory, or killed and restarted.
Choosing the value is a balance. Too high gives little protection, and too low causes failures for normal requests, such as large uploads or reports. Measure typical use and add headroom.
Layered caps work best, with an application limit that fails gracefully and a system limit behind it as the hard stop. Monitor for processes that hit the cap, since that points at either a bug or an attack.