After spending a couple of days looking at logs and configurations for the involved components, I was about to throw in the towel and revert back to Fedora 30, where this seems to work straight out of the box.
Focusing on firewalling, I realized that disabling
firewalld seemed to do the trick, but I would prefer not to do that. While inspecting network rules with
iptables, I realized that the switch to
nftables means that
iptables is now an abstraction layer that only shows a small part of the
nftables rules. That means most - if not all - of the
firewalld configuration will be applied outside the scope of
I was used to be able to find the whole truth in
iptables, so this will take some getting used to.
Long story short - for this to work, I had to enable masquerading. It looked like
dockerd already did this through
iptables, but apparently this needs to be specifically enabled for the firewall zone for
iptables masquerading to work:
# Masquerading allows for docker ingress and egress (this is the juicy bit)
firewall-cmd --zone=public --add-masquerade --permanent
# Specifically allow incoming traffic on port 80/443 (nothing new here)
firewall-cmd --zone=public --add-port=80/tcp
firewall-cmd --zone=public --add-port=443/tcp
# Reload firewall to apply permanent rules
Reboot or restart
dockerd, and both ingress and egress should work.