I think someone mention this before but this is could be the issue. Docker Hub Images With Malicious Monero Money Miners?