Or you can use DNAT and SNAT for the container.
On my hetzner setup I assign a ipv6 ula address range to the entire container bridge (every bridge get its own /64 ula prefix) and use the created ipv6 interface address from container in the subnet for the SNAT and DNAT iptables rules.
I know NAT is not designed to use with ipv6.
I tried to split up the public /64 range into smaller pieces, but the hist won’t tell a container specified ipv6 via dhcp to the bridge.
Another way was to add the specified ipv6 address in the container itself. This was not my target