I've resorted to adding my own firewall rules to the 'raw' table, which pretty much preempts all the rules Docker or the distribution inserts.

It's not as powerful as the later tables in the chain (see https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilte... ) but a lot more robust.