Container can ping, but not wget/apt/apk

Docker Engine General
1

I am running Docker in a VM and I can’t seem to access anything from a container over http on this particular KVM host.

For example:

$ docker run --rm alpine ping www.google.com
PING www.google.com (172.217.8.164): 56 data bytes
64 bytes from 172.217.8.164: seq=0 ttl=50 time=37.728 ms
64 bytes from 172.217.8.164: seq=1 ttl=50 time=37.217 ms
64 bytes from 172.217.8.164: seq=2 ttl=50 time=37.266 ms
^C
--- www.google.com ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 37.217/37.403/37.728 ms

$ docker run --rm alpine wget -S -T 5 http://google.com
Connecting to google.com (172.217.4.46:80)
  HTTP/1.1 301 Moved Permanently
  Location: http://www.google.com/
Connecting to www.google.com (172.217.8.164:80)
wget: download timed out

$ docker run --rm ubuntu apt update

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Err:1 http://security.ubuntu.com/ubuntu bionic-security InRelease
  Connection failed [IP: 91.189.88.174 80]
Err:2 http://archive.ubuntu.com/ubuntu bionic InRelease
  Connection failed [IP: 91.189.88.173 80]
Err:3 http://archive.ubuntu.com/ubuntu bionic-updates InRelease
  Connection failed [IP: 91.189.88.162 80]
Err:4 http://archive.ubuntu.com/ubuntu bionic-backports InRelease
  Connection failed [IP: 91.189.88.174 80]
Reading package lists...
Building dependency tree...
Reading state information...
All packages are up to date.
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/bionic/InRelease  Connection failed [IP: 91.189.88.173 80]
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/bionic-updates/InRelease  Connection failed [IP: 91.189.88.162 80]
W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/bionic-backports/InRelease  Connection failed [IP: 91.189.88.174 80]
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/bionic-security/InRelease  Connection failed [IP: 91.189.88.174 80]
W: Some index files failed to download. They have been ignored, or old ones used instead.

I’ve tried building the VM with several different distros, all with stock defaults and they all have the same issue. Neither the KVM host or the Docker VM exhibit any similar issues. I have verified that I am using the default 1500 MTU on the NIC on the host, the VM, switch and Docker. Any ideas what might be causing this?