[root@rhel7 docker]# firewall-cmd --zone=public --add-port=80/tcp --permanent
success
[root@rhel7 docker]# firewall-cmd --reload
success
[root@rhel7 docker]# iptables-save | grep 80
-A POSTROUTING_ZONES -o eno16780032 -g POST_public
-A PREROUTING_ZONES -i eno16780032 -g PRE_public
-A PREROUTING_ZONES -i eno16780032 -g PRE_public
-A FORWARD_IN_ZONES -i eno16780032 -g FWDI_public
-A FORWARD_OUT_ZONES -o eno16780032 -g FWDO_public
-A INPUT_ZONES -i eno16780032 -g IN_public
-A IN_public_allow -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT

[root@rhel7 docker]# telnet localhost 80
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused