If you ensure your working set stays bounded, having swap enabled (say, with swappiness 1) is not a big deal. If you're worried about the performance characteristics of swap, you've already conceded that you aren't confident in the bounds of your working set. So it doesn't seem like the relevant question is "Do we want to have well-bounded memory or use swap?" so much as "Can you tolerate some temporary slowness more easily than a server crash?"