Containers lose internet access after a host firewall reload

HOST1 is an Ubuntu Docker host on the server LAN (ens192, 10.0.10.21/24, gateway FW1 at 10.0.10.1). FW1 is the edge firewall and source-NATs the 10.0.10.0/24 server LAN to the internet. The web container runs on the default bridge (docker0, 172.17.0.1/16) at 172.17.0.2 and publishes port 8080.

At 14:05 an engineer added an SSH allow rule to /etc/iptables/rules.v4 and ran netfilter-persistent reload. From 14:06 the web container's calls to the payment API time out, and monitoring reports the published port 8080 down. From HOST1 itself, curl https://api.example.com works.