AFAICS searching https://docs.docker.com, the 1st container having 172.17.0.2 is not a guarantee, and neither is it a guarantee that that address is accessible from the host.
Container networking | Docker Documentation mentions that the default bridge is deliberately protected with iptables rules and suggests connecting to containers from the outside via published ports.