This used to be true, and is still true when your system uses a Linux Kernel < 4.11. For Kernel 4.11 and later docker takes care of lifting that restriction.
See: Non-root user able to bind to port 80; why? - #6 by meyay
Small note: images are the blueprints that are stored local, in registries or transferred on the wire when pulling/pushing an image. The runtime instance is a container.
If GPSD listens on port 2947/tcp or 2947/udp, it shouldn’t matter if the SignalK container is attached to the host network, or a bridge network. Since traffic coming from a bridge network is source natted (container ip replaced with host ip), it will appear like the traffic was send from the host directly.