Comment by exceptione

  > Specifically for docker it is a very common gotcha that the container runtime can and will bypass firewall rules and open ports anyway. 

Like I said in another comment, drop Docker, install podman.