There is a solution to not require using privileged mode on the container for wireguard:
https://forums.docker.com/t/sysctl-error-setting-key-net-ipv4-conf-all-src-valid-mark-read-only-file-system/92567/11
https://github.com/linuxserver/docker-wireguard/blob/master/Dockerfile
This prevents setting the net.ipv4.conf.all.src_valid_mark=1 key if it is already set.
For ex:
sed -i 's|\[\[ $proto == -4 \]\] && cmd sysctl -q net\.ipv4\.conf\.all\.src_valid_mark=1|[[ $proto == -4 ]] \&\& [[ $(sysctl -n net.ipv4.conf.all.src_valid_mark) != 1 ]] \&\& cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1|' /usr/bin/wg-quick &&
This would make the container more secure and prevent extended privileges on the host. This approach can also be utilized in the other wireguard containers as well, such as sabnzbd and deluge.
There is a solution to not require using privileged mode on the container for wireguard:
https://forums.docker.com/t/sysctl-error-setting-key-net-ipv4-conf-all-src-valid-mark-read-only-file-system/92567/11
https://github.com/linuxserver/docker-wireguard/blob/master/Dockerfile
This prevents setting the net.ipv4.conf.all.src_valid_mark=1 key if it is already set.
For ex:
sed -i 's|\[\[ $proto == -4 \]\] && cmd sysctl -q net\.ipv4\.conf\.all\.src_valid_mark=1|[[ $proto == -4 ]] \&\& [[ $(sysctl -n net.ipv4.conf.all.src_valid_mark) != 1 ]] \&\& cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1|' /usr/bin/wg-quick &&This would make the container more secure and prevent extended privileges on the host. This approach can also be utilized in the other wireguard containers as well, such as sabnzbd and deluge.