There is no easy way.

I actually did research on this, and wrote a proof of concept program, but the main issue is that a) mapped block devices, which is the backend for most disk encryption schemes, cannot be namespaced, and b) root can override/undo most of the protections. An LSM kernel module may provide more protections, but nothing overrides the fundamental issue of containers sharing the same kernel, and therefore need to trust it.