Search:

Containerd is making it sound like it's docker which likely has a root cron restarting it should the process crash or be killed. You could try
sudo ss -tulpn and then
cat /proc/<pid>/cmdline or...

Does dpkg report ii or something else?

dpkg -l whatweb
or for more verbose output:

dpkg - s whatweb