Each container should have outbound traffic set to a very low level to prevent the container from becoming a viable source for real attacks.

There should also be some logic in the app that detects sustained outbound traffic and shuts the container down.