Agetty for user git full mem and swop

Git user should not run any processes. Your server has been compromised, and that is a process pretending to be agetty, which is actually a cryptominer. See this post: CVE-2021-22205: How to determine if a self-managed instance has been impacted