Hacker News Reader

You can run WireGuard in a docker client without giving it access to your internal networks.

Yes, a network namespace is all it takes. However, kernel support for WireGuard is still required. Debian Buster didn't have it back then.