Am I attacked or just stupid?
This looks like DoS, most likely originating from nework or from inside of one of compromised container.
I'd look into vmstat, run it continually every 5 seconds: vmstat 5 and take a note where resources are spent. You can also use screen and run vmstat 60 (every minute) in a separate window - this way you can notice spikes when they happen over longer period of time.
In this situation high/spiking System CPU(sy), high context switch rate (cs) and high IO (it shows both network and disk) will indicate DoS:
$ vmstat 5
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 9584 6820 132432 23256 1 1 136 12 1 1 83 1 15 0 0
0 0 9584 6696 132432 23256 0 0 0 0 20 32 0 0 99 0 1
At the same time monitor the network traffic on host, i recommend ntop, ie:
$ nload -t 10000 -u H eth0