Am I attacked or just stupid?

This looks like DoS, most likely originating from nework or from inside of one of compromised container.

I'd look into vmstat, run it continually every 5 seconds: vmstat 5 and take a note where resources are spent. You can also use screen and run vmstat 60 (every minute) in a separate window - this way you can notice spikes when they happen over longer period of time.

In this situation high/spiking System CPU(sy), high context switch rate (cs) and high IO (it shows both network and disk) will indicate DoS:

$ vmstat 5
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
 r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0   9584   6820 132432  23256    1    1   136    12    1    1 83  1 15  0  0
 0  0   9584   6696 132432  23256    0    0     0     0   20   32  0  0 99  0  1

At the same time monitor the network traffic on host, i recommend ntop, ie:

$ nload -t 10000 -u H eth0