[Legogris]

Is there any reason why OP installs iproute2 and iptables not in the builder together with the wireguard package but in the final container image?

[simcop2387]

The packages installed in the builders are essentially never used since it never runs. The builder makes the files to install in the final container during the build phase, and then gets thrown away.

[Legogris]

Oh, of course. Brainfart there.