docker uses iptables passthrough... which makes firewalld call into iptables directly. I will readd iptables buildrequirement for now.