And so it is:

@intersystems-iris-community-edition-1-vm:~$ cd /opt/ISC
@intersystems-iris-community-edition-1-vm:/opt/ISC$ sudo vim docker-compose.yml
@intersystems-iris-community-edition-1-vm:/opt/ISC$ sudo docker-compose up -d
Recreating try-iris ... done
@intersystems-iris-community-edition-1-vm:/opt/ISC$ sudo docker ps -a
CONTAINER ID        IMAGE                                            COMMAND             CREATED              STATUS                                 PORTS                      
                                                            NAMES
db93ab338e46        intersystems/iris-community:2019.4.0.379.0-gcp   "/iris-main"        About a minute ago   Up About a minute (health: starting)   0.0.0.0:9100-9101->9100-910
1/tcp, 0.0.0.0:51773->51773/tcp, 0.0.0.0:52773->52773/tcp   try-iris
 

It is not a firewall issue. It is a docker issue. Apparently you cannot add a port to a docker container once it has already been run/initiated. It has to be done at the initiation step.  The initiation step is already done when the google cloud instance is created so you cannot go back and un-initiate it.  -- IV

I am not 'sure' if I want to change system routines. IRISLIB is read only. Probably not change Cache occurrences in IRISLIB. I've made no effort yet to see where these routines actually reside and %RCHANGE doesn't tell me where. RPMS traditionally uses Cache and Ensemble which are no longer sold. Intersystems IRIS Adoption Guide seems to indicate that all Cache references be replaced by IRIS.  I use D ^%CD to use RPMS namespace before %RCHANGE. I do not know if that restricts %RCHANGE to that namespace.  I suspect from the messages I am getting that %RCHANGE tries to change all occurrences.