A hacked client site can't spam and can't scan

You host thirty client sites, one per container. One of them runs a CMS plugin nobody has updated since 2023. It gets owned on a Tuesday.

The webshell tries to send mail: ports 25, 26, 366, and 2525 are blocked at the host for every container, so the spam run dies on the first connect. It tries to scan for neighbours: private and special-use ranges are blocked at the host, and the container sits alone on its own /30 bridge anyway. It tries to read the other sites' wp-config: different root filesystems, nothing there.

What's left is one defaced container. You restore Monday's snapshot and patch the plugin.

On a shared VPS that would have been a blacklisted IP and twenty-nine apologies. The two things a hacked web box does first are the two things the host refuses by default.