Maybe you can map the port of your fluentd container to the port on 127.0.0.1 and use localhost instead of the container hostname?
So the port is not open to the public, but can be reached from the host.
It works to open the ports on host itself and to refer localhost in fluentd address. This is also okay or even better, because I do not need to attach fluentd container in all networks.
Now I just need to find out why collabora and nextcloud are not working anymore. I guess this is also related to changed dns behavior.