firewalld allowing traffic to docker container. Why is it so?

Question

I am trying to get the firewalld concepts right. Installed docker and firewalld on Rocky Linux 9.0. My ngnix container is UP and running on port 8089. Without http services in any of the firewalld zones, how does traffic hit my nginx server? My default zones are public & docker.

$ sudo firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0 eth1
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
$ sudo firewall-cmd --zone=docker --list-all
docker (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: docker0
  sources: 
  services: 
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: