The simplest solution of all, as far as I can tell, is to add a new virtual interface to the host (all hypervisors provide this functionality; or use macvlan on bare metal) and assign it to the container after obtaining layer 3 information about it (DHCP, static addressing, whatever). Then you don't have to worry about the complexity of overlay networks or NAT.
What's the objection to this?