That's an interesting idea about using a unified network interface. Do you know how you might then get the right packets to the right containers/processes? Does that even matter with Wireguard?
Example vpn container:
docker run --name foo --cap-add=NET_ADMIN ...
docker run --net=container:foo ...
[1] i.e. https://github.com/bubuntux/nordvpn/blob/master/start_vpn.sh...