I'm confused. Does docker change the routing table? Otherwise there will be no route back to the attacker's machine.

Also, if 172.16.0.0/12 is bound to the docker0 interface then the kernel will see packets from IPs in that range that come in on other interfaces as martians and drop them.