After a 2 week deep dive into networks in general, docker networking in particular and how docker interacts with iptables, I now feel confident to answer my own question:

First of all, this has nothing to do with ssh tunnels. Anything you bind to the loopback address 127.0.0.1 will only be accessible from the local machine itself, and cannot be accessed from outside the machine's network interface. Docker here counts as "outside" because it has its own network (by default in the 172.16.0.0/12 range). This is a crucial part of the whole isolation concept of docker, it keeps the containers separate from the host and each other.

So how to make this work? There are a few options:

• Bind whatever service you need to the docker gateway ip:

  ssh -fnNT -R 172.17.0.1:8080:localhost:80 remote-host
  

  For this to work you need an additional iptables rule, something like:

  iptables -I INPUT -i docker0 -d 172.17.0.1 -p tcp --dport 8080 -j ACCEPT
  

  This allows traffic coming from the default docker0 network to the docker gateway ip on port 8080. Without this rule, these packets would be dropped.

• A bit easier, just bind it to all interfaces:

  ssh -fnNT -R 0.0.0.0:8080:localhost:80 remote-host
  

  The security concerns here probably depend on your individual use case and network architecture. But if you have a simple VPS with a public IP and your iptables INPUT policy is DROP, this is not a problem. I was confused here because when you publish a port with docker like -p 8080:80, docker will create an iptables rule to ACCEPT requests from outside the host, because it is insecure by default. If you bind any other (non-docker) service to a port on 0.0.0.0, it will still be blocked until you open it manually.

• Tunnel into the container, using the host as a jump proxy. This requires your container to have an openssh server running, which is a bit tricky in itself, and the port needs to be published on the host too, for example with -p 127.0.0.1:2222:22. If you're using docker compose and don't mind starting another service, you could use docker-openssh-server for this.

  Then it's just a matter of:

  ssh -fnNT -R 0.0.0.0:8080:localhost:80 remote-container
  

  When combined with a setup in .ssh/config, for example

  Host remote-host
      HostName remote-host.example.com
      User peter
      Port 22
  
  Host remote-container
      ProxyJump remote-host
      HostName localhost
      User containerpeter
      Port 2222
  

  this will first ssh into your remote host, then from there open the remote tunnel directly into the container. You could of course open the container ssh port to the public and tunnel into there directly, but it's so much more fun with a jump.

• You could meddle with the iptables PREROUTING chain in the nat table as suggested here, routing the requests with destination 172.17.0.1 to 127.0.0.1. I haven't tried it though, so can't guarantee for the result.

• You could use a tool called socat as explained here, which can do TCP forwarding among many other things. Also have not tried this approach.

If you're now excited to jump into solving a similar issue yourself, here are some handy tools.

See wich processes listen to which port on which interface. One of:

lsof -i -P -n | grep LISTEN
netstat -tulpn | grep LISTEN
ss -tulpn | grep LISTEN

Trace requests through the iptables chains:

# First insert a rule with target TRACE into the INPUT chain 
iptables -I INPUT -p tcp --dport 8080 -j TRACE

# Then look at the packets while they are going through the chains
xtables-monitor --trace

Happy networking.

Firstly you need to install a SSH server in the images you wish to ssh-into. You can use a base image for all your container with the ssh server installed. Then you only have to run each container mapping the ssh port (default 22) to one to the host's ports (Remote Server in your image), using -p <hostPort>:<containerPort>. i.e:

docker run -p 52022:22 container1 
docker run -p 53022:22 container2

Then, if ports 52022 and 53022 of host's are accessible from outside, you can directly ssh to the containers using the ip of the host (Remote Server) specifying the port in ssh with -p <port>. I.e.:

ssh -p 52022 myuser@RemoteServer --> SSH to container1

ssh -p 53022 myuser@RemoteServer --> SSH to container2

I resolved this problem by switching to the remote server's Docker context on my local machine:

docker context create some-context-label --docker "host=ssh://user@remote_server_ip"

docker context use some-context-label

docker ps
# A list of remote containers on my local machine! It works!

After that:

1. Connect via Remote-SSH to the container server
2. Right click relevant container -> the "Attach Visual Studio Code"

That works for me.

(Note: One would think that I should be able to just use my local VSCode (skip step 1) to connect to said remote container after switching my local context, but VSCode complains Failed to connect. Is docker running? in the Docker control pane.)