This is not really about getting things going at my own site it's about getting a docker set up designed that works for anyone.
If I set the "hostname" on the Dockers to "portal.arcgis.net" and "web-adaptor.arcgis.net" instead of just the names "portal" and "web-adaptor" AND I create an entry in DNS that matches the Docker bridge network then I can get it to work. This is just a hack since it requires looking up internal network IP addresses and putting them in my LAN DNS (outside of docker)
I am still learning about the wrinkles of Docker networking and DNS resolution. There is a "hostname" option when you start docker and there is also a "network-alias" option. If I use "network-alias" the hostname is not change but docker machines can see each other with those names.
For example, I can set the portal container to have the alias "portal" and then all the other containers can see it as "portal" without any other config.. except for ESRI.. for example I can use curl from web-adaptor and it can reach both "https://portal:7443" and "https://portal.arcgise.net:7443/" but apparently Portal and WebAdaptor refuse to use Docker's internal resolver and jump out to the outside DNS I specify for resolving names outside.
If I specify a simple name for hostname like "portal" (which is normal) then the ESRI software will go all the way through the config set up and then when it launches it REALLY REALLY wants to see a complete domain name and fails.
EVENTUALLY I will get it sorted, for now I am working around it by making the hostnames have a full domain name in them. This has the ugly side effect it turns out of making Web Adaptor fail when it's behind a reverse proxy, something new to sort out. But next I have to get PostgreSQL working as the database so all this naming stuff is on the back burner for a day or two.