I did find out the problem. It was firewall on server who was blocking trafic from br-* device / docker network. So I did create new zone in shorewall, add br-xxx interface into that zone and allow trafic between $FW and new zone.
If I understand that correctly, updating container will not change network name and its device name, so I should be OK with shorewall config.