[afeiszli]

You can run WireGuard in a docker client without giving it access to your internal networks.

[fuzzy2]

Yes, a network namespace is all it takes. However, kernel support for WireGuard is still required. Debian Buster didn't have it back then.