EDIT: My suggestion probably doesn't work for your use-case, but I'll leave it for anyone else....
I use this to only tunnel the ports I actually need: https://github.com/DigitallyRefined/docker-wireguard-tunnel
My CGNAT'ed home PC is the client, and my public-facing Oracle Cloud instance is the server.
I've tried and failed miserably to use the "official" Wireguard container. Once I start reading suggestions to modify iptables outside of Docker, I know I'm in trouble.
Oh, I hear you...
Filters can make it so the Mastodon feed doesn't force you to want to walk out into traffic.