I think I’ve figured it out. Apparently now Docker also adds an 192.168. range on top of 172. ranges for its bridge networks:

docs.docker.com/engine/network/#automatic-subnet-…

Copy that example to your /etc/docker/daemon.json on the reverse proxy machine, without the 192.168 line, and restart docker, and the 192.168.65. addresses will go away.

(Don’t forget to remove the trailing comma on the last address line.)