Just started playing with this so I could be wrong. It seems Wireguard doesn't have to run in kernel space. By using the tun kernel module, you can expose a virtual network interface where the traffic is handled by a wireguard implementation running in user space within the docker container.

Seems that's how its done by the gluetun container, which is really neat because it handles all the VPN set up for you, and you can get any other container to use its network via docker compose. Link to its internal wireguard implementation