Thats great! Overly simplistic explanation, the container is in its own little network and when you connect wireguard inside the container it is punching a hole out to where the wireguard server is located. Without knowing your setup its difficult, but that is probably why your ping is acting as it does. The container doesn’t know how to get to where you’re attempting to ping.

The allowed ips is a list, off the top of my head it accepts single IPs and cidr blocks. 0.0.0.0/0 is the cidr block that essentially means all ipv4 IPs, ::/0 is the same for ipv6. So to answer directly, the , is an or, its for any IP in the list.

Does your wireguard config have ipv6 addresses? If your not using them you can safely remove them.

For example Change AllowedIPs = 0.0.0.0/0, ::/0 To AllowedIPs = 0.0.0.0/0

Also could try adding net.ipv6.conf.all.disable_ipv6=1 in the sysctls section

Multiple edits: I’m terrible with formatting while not on a phone.

More edits: just found out i can expand errors and the compose. Looks like it is the AllowedIPs line in peer1.conf. Just removing , ::/0 as above “should” solve it

If you have some spare cash you can look at IODD or Zalman (white label iodd) devices. USB disk drives that also emulate an optical disk drive and mount ISOs.

I bought a Zalman back over a decade ago, still have and use it to this day. Used the daily in at data centres. Bees knees. Looking at the IODD devices now for the USBC port, but the Zalman is still working flawlessly.