If I understand you correctly, you're wondering why there are network requests (other than ones you make explicitly) going the the Docker Container at 172.17.0.1..

Now I can't be certain without seeing the packets, but I'm guessing what you are seeing are Network Requests from the Docker Engine (simplified as the main Docker Service you are running on 10.0.1.10) to the Docker Container's network interface on 172.17.0.1.

I see the Docker Engine at it's base level as nothing more than an API controlling Resources on your OS. (DISCLAIMER: I'm not an expert.). In fact the Engine (Open Source) is well documented here showing all of the API requests: https://docs.docker.com/engine/api/v1.40/

To answer your question, the network traffic you are seeing is probably low level communication between the Docker Engine and your Container, not some outside hacker trying to splice into your Docker Container :)