You need to have an wireguard kernel support on the host ofc, but else you only need wireguard-tools in the container and can use a wg-quick config like usual.
Also with podman or k8s you don't even need it integrated into one container, as all containers in a pod share the same network namespace, so you can have one container running your workload and another one running the VPN.
I've been using my CIEMs with Fiio's UTWS3[0] and it's been great, pretty decent sound quality with APT-X tho sadly no LDAC. Also no ANC but imo the isolation of customs is good enough already. The software is also a joke, but basicly nothing has a proper parametric EQ anyways.
Also recently learned about UE FITS[1] which are TWS and mold to your ears at home.
Even if you reduce it down to /48 subnets you have 281,474,976,710,656 of these, ~65k times more than the entire IPv4 space, your usual assignment to a machine is a /64 which are about 4.2 billion times the amount of the IPv4 address space, about 18 quintillion.
Thats enough addresses to give every one of the 8 billion humans on this planet, two billion /64 subnets. Which I'd say should be enough for the moment.
You gotta draw a line somewhere and I'd probably draw it in proximity to the documented behavior, and apply some superheated sanity to it while at it.
Every change ever will upset somebody.
And at the point where you have enough users you have better stuff to care about than some people that natural selection will get to sooner than later.
You need to have an wireguard kernel support on the host ofc, but else you only need wireguard-tools in the container and can use a wg-quick config like usual.
Also with podman or k8s you don't even need it integrated into one container, as all containers in a pod share the same network namespace, so you can have one container running your workload and another one running the VPN.