Although question is still of some interest, I can repro with ipaddress:8200 from a Linux VM into Windows 10 Duplicati.Server.exe --webservice-interface=*, starting from the first HTTP request. Browser developer tools makes this pretty easy to see, at least from the browser Network view.
Adding (accidentally?) renamed --webservice-allowed-hostnames=* resolved the 400 error.
So possibly if it’s absolutely necessary to remain on 2.0.9.102, you can fight with Docker further.
possibly would be better like
CLI_ARGS="--webservice-allowed-hostnames=*"
but I don’t use Docker, and am also not familiar with LSIO.