I've noticed you're doing connection stitching with socat due to issues with qemu user networking. I've come across a similar issue and it looks like it can be solved with just one command:

iptables -t nat -A INPUT -j SNAT --to-source 10.0.0.2

With this one, I can connect to hostfwd port from outside the container