I think it's a bit disappointing how unsophisticated these cryptominer attackers are. If you have the ability to spawn arbitrary Docker containers, you can get root privileges on the host -- which would make tools like this one (which as far as I can tell only measures container network traffic) useless.
The real solution is to stop exposing access to Docker (or Kubernetes without any RBAC rules) to the open internet.