First thing a malware would do is to replace top/ps and related utilities, to mask itself. Or directly replace kernel calls. You will not notice by just checking running processes

So why would this need docker at all?

Thanks so much for mentioning this, trying it out now

Not at all

One thing that hasn’t been said in this thread is the following: Do you trust your router? Do you have an isp that can probe your router remotely and access it? In those cases, you absolutely need a firewall

Same, always eorked great for me