Filling some gaps:

systemctl enable --now firewalld unattended-upgrades

Read through /etc/firewall/firewalld.conf, especially the part about how containers might bypass your firewall if you don’t change defaults.

Also rootless podman should run well out of the box as a mostly drop-in replacement for docker (meanwhile docker also does rootless now) and allows you to run the container runtime unprivileged. Setting up autostart by writing systemd .service unit files works the same for both.