EDIT: My suggestion probably doesn’t work for your use-case, but I’ll leave it for anyone else…
I use this to only tunnel the ports I actually need: https://github.com/DigitallyRefined/docker-wireguard-tunnel
My CGNAT’ed home PC is the client, and my public-facing Oracle Cloud instance is the server.
I’ve tried and failed miserably to use the “official” Wireguard container. Once I start reading suggestions to modify iptables outside of Docker, I know I’m in trouble.
Adding this device this also appeared to fix my https://github.com/haugene/docker-transmission-openvpn container that recently died. (And not simply giving it elevated privileges, as was previously recommended)
https://github.com/haugene/docker-transmission-openvpn/issues/2883
It appears that these issues all originate from an update to runc (which is used by containerd): https://github.com/containerd/containerd/issues/11078