The whole point is that you checked that the container gets no access to the network.

Not to mention why wouldn't you let a shell script container keep running?

You can use quotas to mitigate that risk, and monitoring to discover it. You'd be monitoring CPU usage anyway, whether or not you build your own images or write your own Dockerfiles.