Docker overrides UFW rules (github.com)

Good: Firewalld and docker play well together

Better: Forget docker, use podman Bonus with podman: not dependent on newer Portainer releases with nag screens, because Cockpit does the job