We simply stopped using Docker's control of the firewall. It also takes docker-proxy out of the equation so you have far more control and it's less resource intensive (docker starts a proxy instance per port exposed).

I've commented here in the past about my feelings on Docker's attitude towards real issues raised by users, the only way I can describe it succinctly is "contempt".

There's some serious flaws, with tickets that are the best part a decade old now, one simply can't rely on them to do anything.

Stop using Docker or solve the issue yourself is my advice.