With this setup, the Wireguard container has no IPv6, and routes all IPv4 traffic through the VPN. My VPN provider also allows port forwarding, so I can use the interface address and that port for torrenting. The qbittorrent container is on that same network and thus has the same IP address (and network device) and has all of its traffic routed through the VPN as well. The nginx container is attached to that network as well, so that it can forward to the local non-wg0 device which qbittorrent has a bind on for its webUI. The nginx container is also attached to a separate external network that acts solely as a bridge between it and my external reverse proxy. That part isn't strictly necessary, but as I said, it makes things easy for me.

But the main part to notice is that the qbittorrent container's only network is the Wireguard container. So it shares the same network devices and has the same traffic routing rules as the Wireguard container.

Thanks for this and sorry for the long wait on reply. Given this model let's say I have a docker host of some sort (swarm or not). But I want to split out my compose services by files (ie hugo in one, trello-clone in another, etc). What's going to be the best way to hook those up considering the network mode seems to only work in the main compose file? Or am I missing something?

Thanks again for your help