After looking at the guidance you provided I'm still not sure how this would work with dynamic IP addressing.
Here's what I'm trying to do.
One firewall to support one machine the (host machine) as well as that same firewall supporting x amount of docker instances that IPs change upon reboot as well as different networks.