The three bits that are set are IFF_MULTICAST, IFF_BROADCAST and IFF_UP. This looks like an interface that is UP
And that corresponds perfectly well to the actual flags output:
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP>
↑ ↑ ↑
Why does ip link report state DOWN?
That's a different kind of state.
The flag IFF_UP (shown above as "<UP>") describes administrative state, which is the manual knob that you can set via ip link set eth0 up.
On the other hand, the "state […]" text describes operational state, which indicates whether the interface is capable of working.
Operational state is roughly the same as 'carrier' presence – e.g. Ethernet link fully established, or Wi-Fi access point associated to. A bridge is reported to be up (have a carrier) if at least one of its member ports is up. For that reason you may want to add a dummy0 interface as bridge member.
Operational state roughly corresponds to the flags IFF_LOWER_UP (shown as "<LOWER_UP>" in the flags area) and IFF_RUNNING (its absence shown as pseudo-flag "<NO-CARRIER>" in your example). (source code)
However, iproute tools obtain interface information via Netlink, and the state … section is printed based on the IFLA_OPERSTATE netlink attribute. (source code)
This attribute is available via sysfs at …/operstate as well. The Linux documentation has a more detailed explanation of these flags and attributes in operstates.txt.