Each container, by default, runs in a separate network namespace. You can use docker CLI to create specific networks that can be shared with other containers, or use docker-compose for it. Technically, for processes outside containers you can still use the same network of that container by running the inside the network namespace of the 'VPN' container (for example running them with unshare). However, I wouldn't recommend this, as containers are supposed to run mostly isolated workload and not for this kind of use-case. But yeah, technically it's feasible.

It sounds like you want Qubes

Building images is easy enough. It's pretty similar to how you'd install or compile software directly on the host. Just write a Dockerfile that runs the hide.me install script. I found this repo and image which may work for you as is or as a starting point.

When you run the image as a container you can set it up as the network gateway, just find a tutorial on how to set up a Wireguard container and replace Wireguard with your hide.me container.

In terms of kill switches you'd have to see how other people have done it, but it's not impossible.

Idk anything about those softwares, but I would bet if you set up the hide.me client in a container you could add it to the same network in compose then configure all the other containers to use it as their gateway... I'm probably missing some details and you may need to rebuild all of your containers, or maybe just change the network settings in your compose yaml?

Have you had a look at binhex’s privoxyvpn docker container? Sounds similar to what you’re looking to do.

What are you running your containers on? I just put my VPN on the docker host so I could be sure I could use the firewall to block traffic from going out except over the VPN.