I use a variant of this: github.com/linuxserver/docker-wireguard

You don’t need two different containers for this. They’re going to either fight each other for control over the networking tables or run wireguard in wireguard