sudo-gera/reverse-port-forwarding-tun2socks-demo — reverse-engineered prompt

Build me a Docker demo with two containers. One container should have normal Internet access, and the other should be stuck on an internal network where it cannot make outbound connections and can only accept one inbound TCP port, like 7565. I want the isolated container to still get transparent Internet access for both TCP and UDP through the other container, without changing any app settings.

Use a reverse TCP tunnel plus a local socks proxy, a UDP gateway, and tun2socks so apps inside the isolated container can just use the network normally. Include a simple one command startup script, automatic checks that the isolated container starts with no Internet, then gains access, and a restart test that turns tun2socks off and back on to prove it recovers. Please make it easy to verify with curl and an HTTP3 request. If anything is unclear, look up current docs online.