I have a similar setup with rtorrent and wireguard for torrenting:
https://gitlab.com/cocainefarm/containers/rtorrentYou need to have an wireguard kernel support on the host ofc, but else you only need wireguard-tools in the container and can use a wg-quick config like usual.
Also with podman or k8s you don't even need it integrated into one container, as all containers in a pod share the same network namespace, so you can have one container running your workload and another one running the VPN.