Found out that
$ firewall-cmd --get-active-zones
FedoraWorkstation
interfaces: ens4u1u2 wlp59s0
docker
interfaces: br-48d7d996793a
libvirt
interfaces: virbr0
trusted
interfaces: docker0
the interface docker0 seems to be in the trusted zone.
But there’s another zone called docker.
So I decided to give it a shot and add it to the docker zone instead.
$ sudo firewall-cmd --permanent --zone=docker --change-interface=docker0
$ sudo firewall-cmd --reload
Looks like this afterwards:
$ firewall-cmd --get-active-zones
FedoraWorkstation
interfaces: ens4u1u2 wlp59s0
docker
interfaces: br-48d7d996793a docker0
libvirt
interfaces: virbr0
Seems to work.
Maybe someone can shed more light on this.
Edit: added firewall-cmd --reload
as pointed out in the comments