Thats great! Overly simplistic explanation, the container is in its own little network and when you connect wireguard inside the container it is punching a hole out to where the wireguard server is located.

The allowed ips is a list, off the top of my head it accepts single IPs and cidr blocks. 0.0.0.0/0 is the cidr block that essentially means all ipv4 IPs, ::/0 is the same for ipv6. So to answer directly, the , is an or, its for any IP in the list.