Exactly my past experience. Carefully tweaking firewalld a couple of years ago, then docker punched a hole through them by injecting their own iptables rules. Rules which where opaque to the firewall-cmd of course.