Ah, obviously. #docker only gets along with #firewalld if the latter is using the iptables backend (not the higher performing nftables default).
The #iptables backend is depreciated and slated for removal.
And of course there's no error message if configured "incorrectly", just random breakage that one then gets to debug!
I hate computers. I wish I was good enough at something else.
