can wireguard be run from different namespaces so that only certain applications are tunneled through the wg0 interface?