Security log can be analyzed and common attackers networks can be blocked by firewall. RDP port can be changed for the container, follow this MS article: How to change the listening port for Remote Desktop. "Network Level Authentication" can be enabled for such node/containers. If your host is ru