现象

安装Docker官方给出的文档进行安装，都没有什么问题：

直到我执行sudo systemctl start docker时，

报错：
Job for docker.service failed because the control process exited with error code. See "systemctl status docker.service" and "journalctl -xe" for details.

接着我执行systemctl status docker.service结果如下图所示：

说实话，上述基本上没看出来是因为什么导致的：

接着执行dockerd

最后一句话
failed to start daemon: Error initializing network controller: Error creating default "bridge" network: Failed to program NAT chain: INVALID_ZONE: docker
是比较明显的错误信息

问题

这是由于firewalld与docker冲突的问题，从本质上来说，应该是firewalld与iptables的冲突，

来自Docker文档

On Linux, Docker manipulates iptables rules to provide network isolation.
While this is an implementation detail 
and you should not modify the rules Docker inserts into your iptables policies,

链接：https://docs.docker.com/network/iptables/#integration-with-firewalld
具体的我还没搞懂，先挖个坑吧！

解决方案

方法一：
官网的那种方法我试了，没有效果，不过关闭firewalld这个方法是有效的：

```
systemctl stop firewalld
systemctl disable firewalld
```

方法二(更新)：
在Centos上安装Docker对linux版本有要求，最新的Docker不支持老版本的CentOS。
我的大概是7.4x，升级后可以启动！

sudo yum -y update

方法三：

方法来源：Stackoverflow
https://stackoverflow.com/questions/65213831/failed-to-start-daemon-error-initializing-network-controller-error-creating-de

$ firewall-cmd --get-active-zones
FedoraWorkstation
  interfaces: ens4u1u2 wlp59s0
docker
  interfaces: br-48d7d996793a
libvirt
  interfaces: virbr0
trusted
  interfaces: docker0

the interface docker0 seems to be in the trusted zone. But there’s another zone called docker.

So I decided to give it a shot and add it to the docker zone instead.

$ sudo firewall-cmd --permanent --zone=docker --change-interface=docker0
$ sudo firewall-cmd --reload

Looks like this afterwards:

$ firewall-cmd --get-active-zones
FedoraWorkstation
  interfaces: ens4u1u2 wlp59s0
docker
  interfaces: br-48d7d996793a docker0
libvirt
  interfaces: virbr0

Seems to work.
Maybe someone can shed more light on this.
Edit: added firewall-cmd --reload as pointed out in the comments