With Linux containers, the container shares the same kernel as the host. So any vulnerabilities in the host's kernel could be used to escape from the container as root. However, if you keep your system up to date, this is unlikely to be of concern.
The main things to be careful with Docker are:
Mounting filesystems in the container: If you map something ...
In order to prevent reverse-engineering of their Management Engine, Intel used:
An obscure CPU architecture (not their own)
an exotic compression algorithm with hardware-backed dictionary
a less-known OS framework
Ultimately, they failed (well, almost). But they kept secret the internals of the ME for ~10 years.
@Marcus is completely correct about using encryption, and how the key has to be stored somewhere safe and possibly used in conjunction with secure boot. As far as tools go, there are many symmetric and asymmetric encryption schemes that may be suitable for your use case.
However, you can't protect 100% from someone obtaining your firmware. You can only ...
What you want is impossible; there's no "tool" that can do that.
When you encrypt your file, and then only someone in ownership of the key can get the contents – that's the point of encryption. Since you still want to use it, you, however, need to supply that key to the device that will use your image. Can't include the key anywhere unencryptedly ...