Since docker will create a couple of networks, I would prefer to open all the related IPs.
# open all IPs starts with "172" so that all the containers may communicate each other
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address=172.0.0.0/8 accept'
# make our container able to visit the network outside
sudo firewall-cmd --permanent --zone=public --add-masquerade
# apply the change
sudo firewall-cmd --reload
You may visit /etc/firewalld/zones/public.xml for your final result.
Here is my example:
PublicFor use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.