Gluetun is great, but it does not work with docker swarm. I’m using a container running wireguard and Dante as a SOCKS5 proxy, everything that needs a VPN is on an internal overlay network and routes through the proxy container. Only the proxy container is part of the public network and all external traffic goes through the VPN. I use Traefik as a reverse proxy which is part of both the private and public networks. Meaning I can access the private containers (qbitorrent, prowlarr and sonarr) externally through Traefik but they cannot access anything outside the internal private network unless they route though the proxy container.

It’s not perfect but it works xD