couldn't the "containers don't get anything that goes to ::1 on the host" problem just be solved by an nftables rule?
like, you cannot DNAT to ::1 because the kernel will drop it because of some specific wording in the IPv6 RFC about how you're supposed to drop packets with ::1 dst that are coming in from the outside or smth
however, if the containers have their own ULA, say fd80:b00b:5::/48, with a gateway that has the right port forwards to containers at fd80:b00b:5::1
and say you have some container listening on port 2137
can't you just do
table ip6 container-nat {
chain prerouting {
type nat hook prerouting priority dnat; policy accept;
ip6 daddr [::1] tcp dport 2137 dnat to [fd80:b00b:5::1]:2137;
}
chain postrouting {
type nat hook postrouting priority snat; policy accept;
}
}