SELinux is probably your next step, which may be as simple as switching your host OS to RedHat/CentOS.
I'm not sure if you'll be able to use a VM on your current host, and using only one VM to host all your containers will not protect users from each other. (You could eventually use 1 VM for all free customers + VM per random batches of mid-tier paying customers + VM per premium customer.) VM escapes are much more rare than container escapes, and should be a solid line of defense separating your stuff from your users. The discussion I referenced recommended libvirt.
https://dadario.com.br/preventing-docker-escaping-attacks/
> 1) Run the container as non-root user
> 2) [Use] a read-only file system
SELinux is probably your next step, which may be as simple as switching your host OS to RedHat/CentOS.
I'm not sure if you'll be able to use a VM on your current host, and using only one VM to host all your containers will not protect users from each other. (You could eventually use 1 VM for all free customers + VM per random batches of mid-tier paying customers + VM per premium customer.) VM escapes are much more rare than container escapes, and should be a solid line of defense separating your stuff from your users. The discussion I referenced recommended libvirt.