Since docker will create a couple of networks, I would prefer to open all the related IPs.
# open all IPs starts with "172" so that all the containers may communicate each other
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address=172.0.0.0/8 accept'
sudo firewall-cmd --reload
You may visit /etc/firewalld/zones/public.xml for your final result.
Here is my example:
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
<service name="dhcpv6-client"/>
<masquerade/>
<rule family="ipv4">
<source address="172.0.0.0/8"/>
<accept/>
</rule>
</zone>
Hoping it helps.
参考：
https://stackoverflow.com/questions/40214617/docker-no-route-to-host
