Thanks for the suggestion. This is what I ended up doing, and it works really well.

Thanks looks a lot simpler to setup.

Still doesn’t work. My wireguard conf file looks like this.

Change the HOMENET= to my internal ip range i found with ip addr show.

[Interface]
PrivateKey = MyPrivateKey
Address = 1.1.1.1
DNS = 1.1.1.1

PostUp = DROUTE=$(ip route | grep default | awk '{print $3}'); HOMENET=172.16.0.0/12; ip route add $HOMENET via $DROUTE;iptables -I OUTPUT -d $HOMENET -j ACCEPT; iptables -A OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

PreDown = HOMENET=172.16.0.0/12; ip route delete $HOMENET; iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT; iptables -D OUTPUT -d $HOMENET -j ACCEPT

[Peer]
PublicKey = MyPublicKey
AllowedIPs = 0.0.0.0/0
Endpoint = 1.1.1.1

Thanks for the recommendation. My only concern is trust because the containers do not appear to have many downloads

Not fixed the issue but the post.

deleted by creator

Fixed now.