Wireguard: Two containers (one server, one client) on the same host?

[rucksman]

I am running a Wireguard container as a server in my homelab since quite some time. Now I would like to run another Wireguard container that acts as a client to establish an outgoing connection from my homelab to a VPS on the internet. Can I run two Wireguard Containers on the same host?

[aptalca]

Yes you can. You can also add the client conf to the server container as a secondary config. The readme explains how it's handled.

[rucksman]

Thanks for your quick answer. I read the README beforehand already multiple times but did not find an explanation. It says in Client Mode:

Do not set the PEERS environment variable.

That's why I thought I have to use two containers as my server container of course has this variable set. So the question concerning two containers mainly was because of the port which would be used for both containers, and I would guess that this would lead to problems. But if there is a way to use just one container, this would be my favourite approach.
So basically what you are referring to is that I should only drop a config file for the outgoing tunnel to the VPS into /config/wg_confs/.conf of my server container and restart the container?

[aptalca]

The paragraph right above Client Mode section addresses multiple configs. You can drop the config you get from the other server in and it will be activated. Logs will tell you what's going on.

[rucksman]

I invested some hours now into this but can't get it to work. I always get the following error when starting the container on the homelab server:

...
Warning: /config/wg_confs/wg1.conf' is world accessible
[#] ip link add dev wg1 type wireguard
[#] wg setconf wg1 /dev/fd/63
[#] ip -4 address add 10.100.0.2 dev wg1
[#] ip link set mtu 1420 up dev wg1
RTNETLINK answers: Address in use
[#] ip link delete dev wg1
**** Tunnel /config/wg_confs/wg1.conf failed, will stop all others! ****
**** Disabling tunnel /config/wg_confs/wg0.conf ****
[#] ip link delete dev wg0
[#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE **** All tunnels are now down. Please fix the tunnel config /config/wg_confs/wg1.conf and restart the container ****
[ls.io-init] done.

wg1 is the client conf file which I did put into wg_confs.

This is the wg1 conf file:

[Interface]
Address = 10.100.0.2
PrivateKey = <myPrivateKey>
ListenPort = 51820
DNS = 10.100.0.1

[Peer]
PublicKey = <myPublicKey>
PresharedKey = <myPresharedKey>
Endpoint = <IP adress of VPS>:51820
AllowedIPs = 0.0.0.0/0

I literally searched everywhere, but 10.100.0.0/24 is not anywhere used, neither on the host itself nor in any of the docker networks. What could be the problem?